In the pathname path of unp_connectat(), take a reference on the peer
socket under the per-vnode unp_vp_mtxpool lock, drop that lock, and
vput() the vnode *before* calling unp_connect_peer(), rather than
holding the vnode lock across the connect.

unp_connect_peer() already accepts "a reference on the peer socket" as
a stability guarantee (it is exactly what the descriptor path relies on),
so this is behaviour-preserving. The payoff is that no vnode lock is held
across the connect, which removes the delicate `MPASS(!(return_locked &&
connreq))` "vput() must not sleep while the peer is locked" invariant on
the datagram fast path.

That reference then has to be released, and for the reasons described in
the code, this can only safely happen *after* the PCB is unlocked. The
boolean flag is replaced with a nullable out pointer to return the
reference to the caller so that it can carry out this responsibility.

No functional change intended.

Signed-off-by: John Ericson <John.Ericson@Obsidian.Systems>
Assisted-by: Claude Code (Claude Opus 4.8 and Fable 5)