kern: allow kern_shm_open2 of an anonymous preconstructed shmfd

The motivation here is for future changes to the coredump code to be
able to build up a coredump into a shmfd instead of a vnode, which then
gets tapped out to userland via a character device. This also opens up
the possibility that it's useful for the kernel to be able to construct
a shmfd and pass it out to a process that shouldn't need to write to it.

Reviewed by: emaste, kib, markj
Differential Revision: https://reviews.freebsd.org/D51336