Fix a possible next-hop refcount leak when handling IPSec traffic.

It may be possible to fix this by deferring the lookup, but let's
keep the initial change simple to make MFCs easier.

PR: 246951
Reviewed by: melifaro
MFC after: 1 week
Sponsored by: The FreeBSD Foundation
Differential Revision: https://reviews.freebsd.org/D25519