veriexec: Simplify the initialization of loader tunable

[zlei]

Summary

The loader tunable 'security.mac.veriexec.block_unlink' has already been
flagged with CTLFLAG_RDTUN, no need to re-fetch it with TUNABLE_INT_FETCH.

While here move the definition of sysctl knobs out of function body, which is more common in FreeBSD.

No functional change intended.

MFC after: 1 week

Test Plan

Set kernel env and load module. Verify the loader tunable is correctly set.

Escape to loader prompt:

load /boot/kernel/kernel
load /root/mac_veriexec.ko
set security.mac.veriexec.block_unlink=1
boot

# sysctl -T security.mac.veriexec.block_unlink
security.mac.veriexec.block_unlink: 1

[zlei]

Friendly ping @stevek .