Conditionalize IPSec support on MKIPSEC, defaults to "yes" except on,
you guessed it, m68000.

Add MK* knobs for nearly all of the file systems (except FFS, which will
always be built, and anything related to puffs, which requires a bit more
work), and default them all to "yes" except on m68000, which keeps only
cd9660, kernfs, nfs, and ptyfs.

branches: 1.2.2;
remove SMBFS and nsmb/netsmb - userland part

branches: 1.1.2;
Split out /rescue to its own set and adapt installers/images to add it.

This is meant to make updates safer: if something goes wrong with updating
base, we still have the old, standalone /rescue to recover from.