nullfs: close a race when syncing inotify flags from the lower vnode

After a bypassed VOP, nullfs mirrors the lower vnode's inotify state
onto the upper vnode. The flags were checked with lockless reads
before being updated with the asserting flag set/unset primitives, so
two threads syncing the same vnode concurrently (or a sync racing a
watch being established) could both decide to make the same change;
the loser then trips the "flags already set" assertion on an
INVARIANTS kernel. On other kernels the race is harmless.

Keep the lockless check as the fast path, but re-make the decision
under the vnode interlock before actually changing the flags.

Reproduced in a 4-CPU VM with one thread cycling an inotify watch on
a lower-filesystem file while several threads stat(2) the same file
through a nullfs mount: the unpatched INVARIANTS kernel panics under
this load, the patched kernel runs it to completion.

Fixes: f1f230439fa4 ("vfs: Initial revision of inotify")
MFC after: 2 weeks
Differential Revision: D58344
Reviewed by: markj
Assisted-by: Claude Code (Fable 5)