carp: Fix pullup checks

The conditions used to test whether a pullup is needed were inverted.

While here:

• Fix a bogus assignment to "iplen": it's already initialized to *offp.
• Use in_cksum_skip() instead of manually adjusting the data pointer. Otherwise the mbuf is temporarily in an invalid state, since m_len isn't updated to match.

Reported by: KMSAN
Reviewed by: kp
Sponsored by: Klara, Inc.
Fixes: 37115154672f ("carp: support VRRPv3")
Differential Revision: https://reviews.freebsd.org/D46492