carp: fix send error demotion recovery

The problem is that carp(4) would clear the error counter on first
successful send, and stop counting successes after that. Fix this
logic and document it in human language.

PR: 260499
Differential revision: https://reviews.freebsd.org/D33536