CAM ccbq sanity: checks on insert & remove

[rlibby]

Summary

KASSERT in cam_ccbq_insert_ccb that only XPT_FC_QUEUED ops are queued,
and XPT_FC_USER_CCB ops are not. Otherwise cam_ccbq_ccb_done may be
skipped.

Bounds check the index used for camq_remove in order to panic instead
of scribble on removal of an out-of-bounds index (e.g. consider the
effect of camq_remove of CAM_UNQUEUED_INDEX).

KASSERT in cam_ccbq_remove_ccb that the ccb removed by index was the
one sought.

I used these in order to help debug the recently-patched ccb corruption
issues (D7985 & D8020).

Test Plan

make buildkernel KERNCONF=GENERIC-NODEBUG
make buildkernel KERNCONF=GENERIC
kyua test -k /usr/tests/sys/Kyuafile

[mav]

I have no objections.

[imp]

seems reasonable to me, though I worry about more panic calls in the code. But it is really for a 'can't happen' event, so that's OK.