Fix a race with the clearing of p->p_session->s_ttyvp. NULL the pointer

Fix a race with the clearing of p->p_session->s_ttyvp.  NULL the pointer
out before calling vrele() rather then after.

Fix a bug with v_opencount accounting on revoke().  The underlying device
was being closed properly but v_opencount was being decremented which causes
it to go negative when close() is called on the descriptor later on.  To
fix the bug we zero out v_opencount() when the underlying vnode's device
is disassociated and spec_close() now only decrements it when the device is
associated.

Reported-by: GeekGod
Testing-by: GeekGod, Hiten, David Rhodus.