Clean up struct session hold/rele management. The tty half-closed support

Clean up struct session hold/rele management.  The tty half-closed support
(i.e. showing 'p0-' in the ps output for the tty instead of '??' after a
process has detached) had an issue where the tty would be left with a
reference to the freed session structure in certain situations because the
session structure's ref-counting code was not properly implementing the
release case.  Consolidate the disparate session ref-counting code into
real sess_hold() and sess_rele() functions and ensure that any tty reference
to the session is cleared before the session structure is free()'d.

NOTE: Joerg noticed a 0xdeadc1de (deadcode) panic related to this issue
which means that prior to this fix it was possible for the bug to cause
memory corruption in certain situations.

NOTE: Linux does not implement half-closed tty sessions like BSD.  Add code
to implement fully-closed tty sessions, and document the whole mess, but
leave it conditionalized-out for now.

Reported-by: Joerg Sonnenberger <joerg@britannica.bec.de>