udp: Fix a refcount leak in the tunnel receive path

[markj]

Summary

When the socket has a tunneling function attached, udp_append() drops
the inpcb lock before calling it. To keep the inpcb live, we take a
reference. After commit 742e7210d00b we only dropped the reference if
the tunnel consumed the packet, but we need to drop it in either case.

Fixes: 742e7210d00b ("udp: allow udp_tun_func_t() to indicate it did not eat the packet")