carp: fix send error demotion recovery

The problem is that carp(4) would clear the error counter on first
successful send, and stop counting successes after that. Fix this
logic and document it in human language.

PR: 260499
Differential revision: https://reviews.freebsd.org/D33536

(cherry picked from commit 9a8cf950b259f6833c7562ce941b0cfeae6687e5)