Avoid completing non-dump I/O requests after a panic.

[markj]

Summary

Currently we might call into filesystem or pager code when completing a
non-dump CCB, which typically results in assertion failures or
deadlocks when dumping. D4647 attempted to handle this with a dedicated
CAM doneq, but as was pointed out in the review, that solution may cause
us to fail to unfreeze the device after an error. Try to handle the
problem a different way: filter non-dump CCBs in xpt_done_process(), and
attempt to unfreeze the devq after an error if we're running after a
panic. Stash non-dump CCBs on a list so that they can be inspected
during a debugging session.