Some more nvlist allocations in hold processing need to use KM_PUSHPAGE.

This should hopefully catch the rest of the allocations in the
user hold/release processing that were missed by commit
65c67ea86e9f112177f1ad32de8e780f10798a64.

Contrary to the name of the branch, fixes #1898 and, hopefully the rest of #1868.