Fix keyboard polling "on/off" to support recursion. vt depends on
this, and sc will soon depend on it again.

The on/off request is passed without modification to lower layers,
so the bug was smaller in this layer than in in lower layers (the
sequence on;on;off left polling off when it should be on, but the
sequence on;on;off;on;off... doesn't allow the interrupt handler
to eat the input after an "off" that should't turn off polled mode,
provided lower layers don't have the bug, since this layer is virtual.

The bug was small in lower layers too. Normally everything is Giant
locked for keyboards, and this locks out the interrupt handler in
on;on;off;on;off... sequences. However, PR 211884 says that fixing
this bug in ukbd in r303765 apparently causes the eating-by-interrupt
behaviour that the fix is to prevent.

Discussed with: emax