ficl pfopen: verify file

If the file is verified - do not allow write
otherwise do not allow read.

Add O_ACCMODE to stand.h

MFC of r348249

Reviewed by: stevek, mindal_semihalf.com
Sponsored by: Juniper Networks
Differential Revision: https://reviews.freebsd.org/D20387