secpolicy_vnode_access must be called with the vnode lock held.

Don't unlock the vnode and then tell the caller about what the world
was like while the vnode was locked.  The world changes fast.

(riastradh)