random(4): Match enabled sources mask to build options

[cem]

Summary

r287023 and r334450 added build option mechanisms to permanently disable
spammy and/or low quality entropy sources.

Follow-up those changes by updating the 'enabled' sources mask to match.
When sources are compile-time disabled, represent them as disabled in the
source mask, and prevent users from modifying that, like pure sources.
(Modifying the mask bit would have no effect, but users might think it did
if it was not prevented.)

Mostly a cosmetic change.

Test Plan

Reboot and check the systems would be sufficient. Haven't done so yet. It
compiles.

[cem]

Ping secteam

[gordon]

Logic looks reasonable to me. I have only read through the logic, not tested it myself.

sys/dev/random/random_harvestq.c

67

Not generally a fan of double negatives in logic (ETHER_OFF == 0). But no real objection otherwise.

[cem]

sys/dev/random/random_harvestq.c

67

I'll convert it to single-negative (mask + ~ operator in the use), if that sounds better. I'm also not a fan of double negatives in logic and don't recall why I did it this way.

[cem]

sys/dev/random/random_harvestq.c

67

Hm, actually I want to leave it as is. Both uses of the flag need the current sense as-is and I don't want to restructure the code where it is used.