racct_add_cred_checked is a version of racct_add_cred that adheres to rctl limits.
There is some inconsistency in that racct_add_cred_locked() does not enforce limits, while racct_add_locked() does. I can see why you did it this way though.
Style: the opening brace should be on its own line.
Can we factor the individual handlers out? I see that for process-based rctl we have an extra check of p_state, but we can make that conditional, e.g., by specifying a NULL process pointer when enforcing limits by cred.
Adds a new checked version of racct_add_cred instead of adding the checks into racct_add_cred. Also factors the individual handlers out of rctl_enforce so that they can be re-used for rctl_enforce_cred.