carp: turn net.inet.carp.allow into a RW tunable

Currently CARP starts announcing its state when initialised, regardless
of the state of the other services provided by the server.
As a result, the device can become master while still loading the
firewall ruleset or initialising long-starting service.

This change adds the way to request delayed CARP start by setting the

net.inet.carp.allow=0 in the loader.conf.

Differential Revision: https://reviews.freebsd.org/D38167
MFC after: 2 weeks

(cherry picked from commit ee49c5d33d93a6b10222f64a0dc16590ac2048a0)