rework the synchronisation around suspend/resume.

rework the synchronisation around suspend/resume.

the idea is that access to vmm from userland is gated by the vmm_softc
sc_status field, and then accounted for by the refcnt. you take a read
lock to check the gate, and if it is open then you can take a reference
and do your thing. once you've finished the work then you rele the
refcnt on the way out of the ioctl handler.

the suspend code takes a write lock to close the sc_status gate,
and then uses refcnt_finalise to wait for things in the ioctl handler
to get out.

on resume, the code takes the write lock, sets the refcnt up again for
userland to use, and then opens the gate.

tested by and ok dv@