carp: turn net.inet.carp.allow into a RW tunable

Currently CARP starts announcing its state when initialised, regardless
of the state of the other services provided by the server.
As a result, the device can become master while still loading the
firewall ruleset or initialising long-starting service.

This change adds the way to request delayed CARP start by setting the

net.inet.carp.allow=0 in the loader.conf.

Differential Revision: https://reviews.freebsd.org/D38167
MFC after: 2 weeks