MFC r342639:

When allocating a new keyboard at vt_upgrade() time, unwind any cngrabs
done on the old keyboard and then do the corresponding number of grabs
on the new keyboard.

This fixes a race that can leave the system with a non-functioning
keyboard. It goes like this...

• The bios claims there is an AT keyboard, atkbd attaches.
• SI_SUB_INT_CONFIG_HOOKS runs.
• USB probes devices. Devices begin attaching, including disks.
• GELI prompts for a password for a just-attached disk, which results in a cngrab() while atkbd is the keyboard.
• A USB keyboard attaches.
• vt_upgrade() runs and switches the keyboard to the new USB keyboard, but because cngrab was never called for it, it's not activated and keystrokes are ignored.
• Now there is no functional keyboard and no way to get one; even plugging in a different USB keyboard doesn't help, because the console is still grabbed, still waiting for a GELI pw.