bhyveload: hold /boot and do relative lookups for the loader

The next change will push bhyveload into capability mode right after we
allocate vcpu state, before we've setup or entered the loader, to limit
the surface area that a rogue loader script can touch.

With an explicit -l loader, we don't need to preopen /boot because
changing interpreters isn't allowed. We'll just dlopen() entirely in
advance in that case to eliminate some complexity.

Reviewed by: allanjude (earlier version), markj
Differential Revision: https://reviews.freebsd.org/D43285