Forbid proc: strong file table refs after becoming context's filetable

This fixes a possible file table leak if a filetable contains an fd referring (strongly) to the filetable itself (acid filetable_leak). Now, it will automatically be downgraded to a weak reference after it becomes a context's active file table.

TODO: maybe support consuming a context's filetable to get a strong reference back, provided it's exclusively owned.