Now that the socket recv I/O lock is required in order to enable
receive-side KTLS (see commit 163cdf6a32b9a0f), we can move a check from
out of the socket buffer lock, which in turn will simplify some further
refactoring.
Add a __predict_false annotation while here since we already perform the
same check once before acquiring any locks.