vfs: split the global dentry hash lock into per-chain locks

[gburd]

The dentry cache has had 32 hash buckets since it was written:

#define DENTRY_BUCKETS 32
static LIST_HEAD(dentry_hash_head, dentry) dentry_hash_table[DENTRY_BUCKETS];
static mutex dentry_hash_lock;

One mutex guards all of them, taken at 14 sites. Every path lookup in the
system serialises on it, so name resolution does not scale with CPU count no
matter how well the hash distributes. This gives each bucket its own lock.

Builds on #1502, which must come first: that PR fixes an AB-BA inversion
between dentry_hash_lock and the vnode lock, and a per-bucket lock inverts
against the vnode lock in exactly the same way. Splitting the lock without
fixing the order first would preserve the deadlock while making it harder to
reason about. The "chain locks are leaf locks" rule from #1502 still holds and
is documented alongside the lock array.

Not every site touches one bucket

The split does not assume bucket independence, because three call sites do not
have it:

• dentry_move() unlinks a dentry from the bucket for its old path, inserts it
  on the bucket for its new path, and unlinks every cached child from whatever
  buckets those are on. The child set is unbounded and not known before walking
  it, so this takes all bucket locks, in ascending index order.
• dentry_remove() moves a dentry from its bucket to the "fake" list that
  exists so drele() keeps working on unlinked dentries. That list is now slot
  32 of the same array, so it is locked by the same rule as any other chain, and
  both locks are taken in ascending order.
• dref()/drele() must lock the bucket a dentry is currently on, which means
  reading the index before knowing which lock to take. The index is only stable
  under that lock, and dentry_move()/dentry_remove() can move a dentry
  between buckets, so they read it, lock, then re-check and retry if it changed.
  This converges: a dentry changes bucket only on rename or unlink, not
  repeatedly under a spinning reader.

Ascending-index acquisition is what keeps bucket-versus-bucket ordering safe.

d_hash_index is added to struct dentry to record the current bucket, so an
unlink does not have to rehash a d_path that a rename may already have
replaced. Folding the fake list into the array as slot 32 removes the one chain
that previously had no lock of its own.

A/B switch

OSV_VFS_DENTRY_PERBUCKET=0 aliases every bucket to slot 0's mutex, restoring
single-global-lock behaviour in the same binary, so the split can be measured
without comparing two builds. The flag prints what it resolved to on first
read:

VFSFLAG OSV_VFS_DENTRY_PERBUCKET unset, default 1
VFSFLAG OSV_VFS_DENTRY_PERBUCKET=0

so an A/B cannot silently compare an arm against itself, which is easy to do
when the default is the non-inert value and a --env= gets dropped.

Unmeasured

No throughput claim. This is a defect on inspection (one mutex for 32
existing buckets, 14 acquisition sites, contended by every lookup), and the
motivation is a workload where OSv scales negatively with concurrency while
Linux scales positively. But the contribution of this change specifically has
not been measured yet, and the switch above exists precisely so it can be
attributed rather than assumed. If a reviewer would rather wait for numbers
before taking a lock-structure change, that is reasonable and I will follow up
with them.

Correctness testing on x86_64, with the switch in both positions: tst-vfs,
tst-symlink (141 assertions), tst-remove (38), tst-pipe (87), tst-mmap,
tst-dentry-lock, and the fork tests all pass. Compiles clean with
conf_fork=0; no CONF_fork references.