Change the flow of prison_deref() so it doesn't let go of allprison_lock until it's completely done using it (except for a possible drop as part of an upgrade on its first try). Before this patch, it's possible to unlock and relock allprison_lock multiple times, typically when removing a prison removes its parent.

I'm not sure this is a necessary condition for the next change but it certainly doesn't hurt: add just a little more locking in kern_jail_set(), and now invalid prisons are never seen by any thread holding allprison_lock (except of course the ones creating and destroying prisons). This makes prison_isvalid() redundant, and able to be removed almost everywhere. But instead of removing it, I mostly turned the tests into asserts.

This builds on D27876.