vfs: Consistently validate AT_* flags in kern_* functions.

Some syscalls checked for invalid AT_* flags in sys_* and others in
kern_*.

Reviewed by: kib
Obtained from: CheriBSD
Sponsored by: The University of Cambridge, Google Inc.
Differential Revision: https://reviews.freebsd.org/D32864

(cherry picked from commit 57093f9366b7eeb48054ff2fa77b9d01d2b3cfc2)