MFC r308443, r308459, r308462, r308478, r308786

r308443:
Add -d flag that prints domain only.

PR: 212875
Submitted by: Ben RUBSON <ben.rubson@gmail.com>
Reviewed by: pi

r308459:
Fix missing '-' for the flags -s and -d on both manpage and usage.

Reported by: garga, bde

r308462:
Add flag -B which does the same like batch mode but without exiting after
print. Also add a new flag -s that add blocks size to statistics.

PR: 198347, 212726
Submitted by: Ben RUBSON <ben.rubson@gmail.com>
Tested by: pi
MFC After: 2 weeks.

r308478:
We can't use protect(1) inside a jail(8)!
To avoid have warning for services that are using oomprotect, oomprotect
will only be applied on services that won't run inside jails.

Reported by: allanjude
MFC after: 2 weeks.

r308786:
rc.subr: Swap checks so we only fork sysctl if *_oomprotect is set.