kern: fix oversight in security.bsd.unprivileged_kenv_read

It was intended that one could close the hole back in loader, but the
sysctl was actually not marked TUNABLE.  The hardening menu option thus
did nothing, because we wouldn't read the value from kenv.

Reported by:	markj
Fixes:	6e81fbf583 ("bsdinstall: add a hardening knob [...]")
Fixes:	4fd518fcb2 ("kern: add a security knob to disable [...]")

sys/kern/kern_environment.c

@@ -93,7 +93,7 @@ bool	dynamic_kenv;
 			    panic("%s: called before SI_SUB_KMEM", __func__)
 
 static int unprivileged_kenv_read = 1;
-SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RW,
+SYSCTL_INT(_security_bsd, OID_AUTO, unprivileged_kenv_read, CTLFLAG_RWTUN,
     &unprivileged_kenv_read, 1,
     "Unprivileged processes can read the kernel environment");