netfilter: ctnetlink: fix GFP_KERNEL allocation under spinlock