mac_set_fd(3): add support for jail descriptors

[kevans]

Summary

We'll still add an old-fashioned jail param to configure jail MAC
labels, but for testing it's really easy to grab a jaildesc and use
that.

[olce]

There is an alloc/free mismatch, see inline comment. Else seems good.

sys/security/mac/mac_syscalls.c

591–592