vfs: Let prison_enforce_statfs zero the fsid

[des]

Summary

Currently, we unconditionally zero the fsid before returning a struct
statfs to a jailed process. Move this into prison_enforce_statfs() so
it only happens if enforce_statfs is greater than 1, or enforce_statfs
is 1 but the mountpoint is outside the jail.

PR: 291301
MFC after: 1 week

[des]

@kib can you also please take a look at the PR? the originator claims this used to work as recently as 14.2 but I see no evidence that it has ever worked, the code to zero out the fsid has been there since 1997.

[kib]

In D54214#1238647, @des wrote:

@kib can you also please take a look at the PR? the originator claims this used to work as recently as 14.2 but I see no evidence that it has ever worked, the code to zero out the fsid has been there since 1997.

I concur. I looked both at kern_do_statfs() and at priv_check_cred_vfs_generation{,slow}() on 14.2.0 and then 14.0.0, and I come to the same conclusion as you.