Some more nvlist allocations in hold processing need to use KM_PUSHPAGE.

This should hopefully catch the rest of the allocations in the
user hold/release processing that were missed by commit
65c67ea86e9f112177f1ad32de8e780f10798a64.