reboot: Add sanity checking of write to nextboot.conf

Add sanity checking to the write to nextboot. Move to separate function
and allow force to override all errors. If we can't write nextboot.conf,
don't silently fail anymore.

Sponsored by: Netflix
Reviewed by: kevans, kib, markj, jhb
Differential Revision: https://reviews.freebsd.org/D43803