fhopen: Enable handling of O_PATH, fix some bugs

• kern_fhopen() permitted O_PATH but didn't clear O_ACCMODE flags when it is specified, leading to inconsistencies. For instance, opening a writeable O_PATH handle would not bump the writecount on the underlying vnode, but closing it would decrement the writecount.
• kern_fhopen() didn't handle the possibility that VOP_OPEN could install a fileops table. This is how named pipes are implemented, for instance. Some devfs nodes do this as well, but devfs doesn't implement VFS_FHTOVP.

Factor out some code from openatfp() and use it in kern_fhopen() to
address these bugs.

Reported by: syzbot+517a2c879eede02c03fb@syzkaller.appspotmail.com
Reviewed by: kib
MFC after: 2 weeks
Differential Revision: https://reviews.freebsd.org/D49717