vfs_syscall.c: do not take process lock around the read of P2_NO_NEW_PRIVS

The flag is write-only, and if we raced with reading the action of
setting the flag, we can as well get it under the lock.

Reviewed by: emaste, kevans
Sponsored by: The FreeBSD Foundation
MFC after: 1 week
Differential revision: https://reviews.freebsd.org/D51708