MAC: improve handling of listening sockets

so_peerlabel can only be used when the socket is not listening.

Reviewed by: markj
Sponsored by: Netflix, Inc.
Differential Revision: https://reviews.freebsd.org/D46755

(cherry picked from commit 2fb778fab893b4a8a86ecfa20acf2e23bb2cdae8)