ip_fw: address lock order reversal

Maintain lock ordering in ip_fw2.c by tracking any nested locking
using a flag, and then executing the locking in the correct order.

Reported by: Jimmy Zhang
Obtained from: Jimmy Zhang
Sponsored by: NetApp, Inc.
Reviewed By: glebius, ae
Sponsored by: NetApp, Inc.
Differential Revision: https://reviews.freebsd.org/D48069