urio_open: WRITE-stall flag updated without sc_lock, asymmetric with the locked READ path

Summary

The FWRITE branch sets sc_flags |= URIO_FLAG_WRITE_STALL unlocked while the FREAD branch ten lines above wraps the identical update in sc_lock - violating the file's own protocol since the callbacks that clear the bit run under sc_lock. Impact analysis shows hardening-only: concurrent open writers OR distinct monotone bits and the clearing callbacks cannot execute for a mid-open fifo - worst case one spurious/missed CLEAR_FEATURE(ENDPOINT_HALT). Inherited verbatim from FreeBSD r246128. Mirror-the-FREAD-locking fix.