bhyveload: simplify cb_open() and eliminate minor TOCTOU

It's not at all clear why I wrote it like this, but we can do better.

I wouldn't think this really has any meaningful security implications
since the hierarchy in question can't really be modified by the guest
scripts, but it would seem to make it a little more robust.

Fixes: 6779d44bd878e3c ("bhyveload: use a dirfd to support -h")
Reviewed by: bnovkov, markj
Differential Revision: https://reviews.freebsd.org/D55379