Declare flag/cmd lists externally to syscall descriptors.

This lets us avoid duplication and makes it possible to use nitems() to
count the number of flags/cmds in a set instead of hard-coding. This
change exposed a bug in the rfork(2) descriptor, which wasn't setting
the flag count. Now that it's fixed, we have to disable a few more flags
in its fixup routine.