bridge: Release the bridge lock when calling bridge_set_ifcap()

[kp]

Summary

This calls ioctl() handlers for the different interfaces in the bridge.
These handlers expect to get called in an ioctl context where it's safe
for them to sleep. We may not sleep with the bridge lock held.

However, we still need to protect the interface list, to ensure it
doesn't get changed while we iterate over it.
Use BRIDGE_XLOCK(), which prevents bridge members from being removed.
Adding bridge members is safe, because it uses LIST_INSERT_HEAD().

This caused panics when adding xen interfaces to a bridge.

PR: 216304

Test Plan

Enable WITNESS

ifconfig bridge0 create
ifconfig bridge0 addm xn0
ifconfig bridge0 deletem xn0

[kp]

Fix a really stupid typo.

[ae]

This looks correct to me. Also I think it would be nice to add BRIDGE_UNLOCK_ASSERT() and put it into bridge_set_ifcap(). Or at least add the comment why we do so.

[kp]

Add the suggested BRIDGE_UNLOCK_ASSERT(), because that's a good idea.