fdescfs: Fix a file ref leak

In fdesc_lookup(), vn_vget_ino_gen() may fail without invoking the
callback, in which case the ref on fp is leaked. This happens if the
fdescfs mount is being concurrently unmounted. Moreover, we cannot
safely drop the ref while the dvp is locked.

So:

• Use a flag variable to indicate whether the ref is dropped.
• Reorganize things to handle the leak.

Reported by: C Turt <ecturt@gmail.com>
Reviewed by: mjg, kib
Tested by: pho
MFC after: 2 weeks
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D39189

(cherry picked from commit 0f5b6f9a041e9cca3b376f6ec909374938887a3b)