bhyveload: open guest boot disk image O_RDWR

When a boot environment has been booted via the bootonce feature,
userboot clears the bootonce value from an nvlist but fails to write the
updated nvlist back to disk.

The failure occurs because bhyveload opens the guest boot disk image
O_RDONLY, fix this by opening it O_RDWR.

Reviewed by: imp, markj, jhb
Differential Revision: https://reviews.freebsd.org/D37274