hwpmc: fix false runcount assertion in user callchain capture

pmc_capture_user_callchain() checks a PMC's runcount before walking
the user stack, but reads it without holding the spinlock that
protects it. hardclock() can run on the same CPU during the capture
and drop the runcount to zero in between, tripping the assertion and
panicking INVARIANTS kernels under load.

Move the check inside the existing spinlock, right where the code
already confirms the sample is still valid. No functional change on
kernels built without INVARIANTS.

Signed-off-by: Andre Silva <andasilv@amd.com>
Reviewed by: mhorne
MFC after: 1 week
Sponsored by: AMD
Differential Revision: https://reviews.freebsd.org/D58571