This patch moves more of the stuff in <sys/namei.h> under _KERNEL.
It's pretty trivial, but you never know what might depend on it,
so I'd better ask.
It (obviously) passes tinderbox. The reason for even touching this
is that in CheriBSD we have some __capability annotations there,
and it breaks the build for some non-capability-enabled userspace
thingies, namely vmstat(1).