sys/modules/Makefile: conditionally add MAC/veriexec modules

Only build MAC/veriexec modules when MK_VERIEXEC is yes or we
are building all modules.

Add VERIEXEC knob to kernel __DEFAULT_NO_OPTIONS

Reviewed by: sjg
Obtained from: Juniper Networks, Inc.