vfs_lookup_cross_mount(): fix missing LK_CANRECURSE

[jah]

Summary

This was a rather dumb miss on my part in commit 42442d7a6e.
LK_CANRECURSE is clearly needed in any case in which the covered vnode
is held exclusive across the call to VFS_ROOT(), regardless of whether
it was initially held exclusive or upgraded. The commit message for
that change also noted that unionfs lookup only worked without
LK_CANRECURSE due to a coincidence of the then-current unionfs
implementation. As it happens, said coincidence was recently removed
in commit b952606b4f ("unionfs_lock(): eliminate LK_CANRECURSE special-
case").

PR: 298201
Reported by: olivier
Fixes: 42442d7a6e "Generalize the VV_CROSSLOCK logic in
vfs_lookup"

stress2: add two new unionfs test scenarios

These exercise lookup traversal from tmpfs into unionfs, which is
useful because, unlike UFS, tmpfs does not allow recursion on its vnode
locks by default.

unionfs22.sh exercises these lookups with a normal unionfs mount, while
unionfs23.sh uses '-o below' for the unionfs mount and reproduces the
panic described in PR 298201.

[pho]

I ran all the unionfs tests for 15 hours with D59494.186153.patch applied.
I did not observe any problems, expect the two new test scripts that needs to have the x bit set.