namei(9): fix two ni_startdir leaks

namei() leaks the caller's ni_startdir reference on the empty-path
ENOENT return and on namei_getpath() failure.

On ZFS with the default zfs_xattr_compat=1, an empty user-namespace
extattr name on a file that has an xattr directory leaks one reference
on that directory per call.

Reported by:    llm-postcr


vn_open_cred(9): fix ni_startdir leak

vn_open_cred() returns EINVAL before calling namei() for
O_CREAT|O_EXCL|O_DIRECTORY and for O_CREAT|O_EMPTY_PATH.
That leaks an NDINIT_ATVP() start directory.