Userland cannot correctly set CAM_UNLOCKED; it is internal to the
implementation and not defined in the CAM spec. Thus, return EINVAL if
it's set in the CAMIOCOMMAND or CAMIOQUEUE argument.
I also noticed that some error paths in the CAMIOQUEUE handler don't
free the request or relock the periph, so fix that too.