ufssuspend(4): mark non-passable

This fixes long-standing issue where ufssuspend file descriptor could
leak over fork or be passed over unix domain socket, and then closing it
in the opener would not unsuspend the file system.

It should not affect the well-behaving growfs(8) utility, but makes the
userspace API safer on principle.

Reviewed by: markj
Tested by: pho (previous version)
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D60285