kern: vfs: add MAC checks for mount/unmount/update

[kevans]

Summary

The unmount check is straightforward and only really needs the
struct mount.

The mount check offers as much information as I think might be of
interest to a MAC policy: the vnode to be mounted on, vfsconf, and
applicable mount options. XNU also has a later version that just takes
a struct mount for everything that VFS_MOUNT() has to offer, but my
draft policy doesn't need any of that. It also doesn't really need the
unmount check, but it seems reasonable to add it while I'm here.

The update check similarly passes the flags/options for the operation,
along with the struct mount and label.

[kevans]

My draft policy that uses 2/3 is here: https://git.kevans.dev/kevans/mac_capsule/src/branch/main/mac_capsule.c -- my capsule implementation tries to prevent its parent from gaining visibility or operating in an active capsule's fs. This is somewhat effective because the capsule also can't be removed, so tampering with its fs means you'll need to catch it in the window between system startup and capsule startup, however narrow or wide that may be, or have physical access.

Edit: upon reflection, I guess I need to do something to prevent unmount, too, since that doesn't require the caller to be able to lookup the mountpoint. Admittedly, I'm not yet sure how best to implement that in my policy unless I force capsule roots to be mountpoints (then traverse upward along mp->mnt_vnodecovered and stop if I hit a capsule mount)

[kevans]

Add flags to the mount_check_update for policies that may want to reject a
forced-unmount or handle unmount by-fsid differently