veriexec: Simplify the initialization of loader tunable

The loader tunable 'security.mac.veriexec.block_unlink' has been
already flagged with CTLFLAG_RDTUN, no need to re-fetch it with
TUNABLE_INT_FETCH.

While here move the definition of sysctl knob out of function body,
which is more common in FreeBSD.

No functional change intended.

Reviewed by: stevek
MFC after: 1 week
Differential Revision: https://reviews.freebsd.org/D42132