vfs: Consistently validate AT_* flags in kern_* functions.

Some syscalls checked for invalid AT_* flags in sys_* and others in
kern_*.

Reviewed by: kib
Obtained from: CheriBSD
Sponsored by: The University of Cambridge, Google Inc.
Differential Revision: https://reviews.freebsd.org/D32864