VOP_DEALLOCATE(9) permits a filesystem to return a partial result, and
vn_deallocate_impl() simply loops until the range is consumed. If a
filesystem returns success without shrinking the remaining length, we
spin forever with the rangelock held and no way to interrupt the thread.

Assert that each pass makes progress, and return EIO if it doesn't so
that a buggy filesystem doesn't wedge the caller.

Document the progress requirement in VOP_DEALLOCATE(9) and the new EIO
condition in fspacectl(2).

I did wonder if this should be made interruptible for, e.g., slow I/O
over NFS, but I've declined to touch it for now.