Address some of bdrewery's concerns

I am happy to break it into two separate commits, but I wanted the review to include both so that we see how they work together.

Same here.. does it build in poudriere and do you have the log?

Does it build in poudriere?

Tested good for me!

Address feedback

Thanks @wblock! That is much better!

Address feedback

Implement @ngie's suggestions.

In D10096#208952, @ngie wrote:

You don't have cd9660 support in your kernel, but you have mount_cd9660 on your system. That's why this is happening.

Updated diff to pull in suggestions from @imp and @ngie

Good point.. This is what I am seeing when this test runs:

Opps, missed a few other cases that need this..

Pet -Tlint

Remove extra files

Address wblock@ comments

Attempt to remove the extra pages.

Opps, some extra files included by accident.

In D9641#199405, @robak wrote:

@brd these settings have been around forever. They've been introduced in bsdinstall as off-by-default exactly to flip them on later in bsdinstall and after that, to flip then on in the base OS. It's been used for ages, seems very stable and mature and add another security layer, where no amount of layers is enough. I think its a great, slow and stable way to not violate POLA and introduce better default FreeBSD settings, at least when it comes to security.