ipfilter: Avoid allocating a new ipf token when not needed

Only allocate a new ipftoken_t if one cannot be found. This eliminates
allocating unnecessary token structures that will never be used when
performing simple lookups for existing token structures.

MFC after: 2 weeks