imgact_elf: Clear no-ASLR and -WXORX flags earlier for setugid images

[markj]

Summary

Otherwise an unprivileged user can disable randomization of the base
address for PIEs even if they are setugid.

Add a regression test.

Reported by: David Berard

[kib]

sys/kern/imgact_elf.c

1366

Why moving the VOP_UNLOCK line? If moving, I would put it before the newly moved check imgp->credential_setid

[markj]

sys/kern/imgact_elf.c

1366

I did it this way to avoid changing error handling, and to keep related blocks of code close together. In particular, goto ret requires the vnode to be locked. If you prefer, I will move it earlier and add a new goto label.

[kib]

sys/kern/imgact_elf.c

1366

I think it is simpler to relock the vnode before goto. Yes, I think it makes sense to move the unlock earlier.

[markj]

Unlock the vnode earlier.