Rename security.cheri.debugger_on_sandbox_exception sysctl to
security.cheri.debugger_on_sandbox_unwind to better reflect its
function: entering the debugger on a sandbox unwind event (now
that unwind isn't the response to all exceptions).