pf: fix double free in pf_state_key_attach()

In 371bd29d4b we fixed a state key leak, but unintentionally introduced a double free.
We pass through the relevant code twice, first for PF_SK_WIRE, then for
PF_SK_STACK. If we fail to attach on the second pass we have a more complex
cleanup job, handled by pf_detach_state(). We must only free the state keys
manually on the first pass, on the second one pf_detach_state() takes care of
everything.

Tested by: yds <yds@Necessitu.de>
Fixes: 371bd29d4b22257a7e92e1e711cca3d94cfbd00d
MFC after: 2 weeks
Sponsored by: Rubicon Communications, LLC ("Netgate")

(cherry picked from commit 01eb1261443dddcb50a3a278f1278fffdfb0d36e)