[NETFILTER]: ip_tables: fix module refcount leaks in compat error paths