nullfs: plug vnode ref leak in null_vptocnp

The lower vnode is already referenced and nodeget is supposed to consume
the reference. Thus the extra vref call was causing a leak.

Reported by: pho
Reviewed by: kib
MFC after: 1 week