Add LDFLAGS to PROG_VARS so it can be overridden on a per-PROG basis

MFC after: 1 week
Sponsored by: EMC / Isilon Storage Division
Turn WITNESS_COUNT into a tunable and sysctl. This allows adjusting
the value without recompiling the kernel.  This is useful when
recompiling is not possible as an immediate solution. When we run out
of witness objects, witness is completely disabled. Not having an
immediate solution can therefore be problematic.

Submitted by:	Sreekanth Rupavatharam <rupavath@juniper.net>
Obtained from:	Juniper Networks, Inc.
Merge remote-tracking branch 'freebsd/master' into hardened/current/master
Merge remote-tracking branch 'origin/hardened/current/master' into hardened/current/userlandenhanced