Mask doorbells while processing them.

This fixes interrupt storms on hardware using legacy level-triggered
interrupts, since doorbell processing could take time after interrupt
handler completion, that triggered extra interrupts in a loop.

MFC after: 2 weeks
Sponsored by: iXsystems, Inc.