netfilter: ip_tables: unfold two critical loops in ip_packet_match()