kern: add primitive checked versions of copyin/copyout

[kevans]

Summary

If __builtin_object_size can determine the size of the object that we
are copying to/from, then we can detect some classes of stack disclosure
or overflow if runtime is suitably exercised. That's obviously only as
useful as the tests we write (or fuzzing that we do), but we previously
didn't really have any mechanisms to detect these failure modes except,
presumably, under KMSAN.

Note that we have to use bos 0 here to allow copies to cover any
containing object, for cases like exterr that might copy from one member
to a later part of the containing struct.

[markj]

sys/sys/systm.h

365

Is it possible we are losing the __nodiscard annotation here?

[kevans]

sys/sys/systm.h

365

I... have no idea if it'll get properly propagated or not. I'll double-check that. @andrew also had a suggestion for turning these into an error at compile-time in case the supplied len is a constant expression that I'd like to incorporate.