Make ipf sysctl mpsafe

[cy]

Summary

With the pending retirement of GIANT, this patch will make ipfilter's sysctl's mpsafe.

Test Plan

Currently running on my infrastructure.

[emaste]

LGTM

I assume ipf doesn't run other parts under Giant so does this imply that we've actually had missing locking here all along?

[kaktus]

No, because the sysctl handler was running under Giant implicitly (as it wasn't marked as MPSAFE).

[emaste]

@kaktus yes the handler was under Giant but I meant what did that actually accomplish? But, I didn't look at what the sysctl handler was actually doing.

[kaktus]

That it'll not be run more than one at a time (from userspace).

[cy]

The handler was under "assumed" GIANT. IPF itself uses two other locking mechanisms, common to NetBSD and Solaris (Illumos). I intend to replace them with one of the more modern locks. Given they're called by macros the job won't be as daunting as expected.