fd: further cleanup of kern_dup

• make mode enum start from 0 so that the assertion covers all cases [1]
• rename prefix _CLOEXEC flag with _FLAG
• postpone fhold on the old file descriptor, which eliminates the need to fdrop in error cases.
• fixup FDDUP_FCNTL check missed in the previous commit

This removes 'fp == oldfde->fde_file' assertion which had little value. kern_dup
only calls fd-related functions which cannot drop the lock or a whole lot of
races would be introduced.

Noted by: kib [1]