MFC r308443, r308459, r308462, r308478, r308786

MFC r308443, r308459, r308462, r308478, r308786

r308443:
Add -d flag that prints domain only.

PR:		212875
Submitted by:	Ben RUBSON <ben.rubson@gmail.com>
Reviewed by:	pi

r308459:
Fix missing '-' for the flags -s and -d on both manpage and usage.

Reported by:	garga, bde

r308462:
Add flag -B which does the same like batch mode but without exiting after
print. Also add a new flag -s that add blocks size to statistics.

PR:		198347, 212726
Submitted by:	Ben RUBSON <ben.rubson@gmail.com>
Tested by:	pi
MFC After:	2 weeks.

r308478:
We can't use protect(1) inside a jail(8)!
To avoid have warning for services that are using oomprotect, oomprotect
will only be applied on services that won't run inside jails.

Reported by:	allanjude
MFC after:	2 weeks.

r308786:
rc.subr: Swap checks so we only fork sysctl if *_oomprotect is set.