MAC/do: sysctl_rules(): Always copy the rules specification string

We are not guaranteed that the 'rules' storage stays stable if we don't
hold the prison lock. For this reason, always copy the specification
string (under the lock).

Reviewed by: bapt
Approved by: markj (mentor)
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D47600

(cherry picked from commit 292c814931d975d56d5ffa7c3c85191d56a059c4)