netfilter: nf_conntrack: fix confirmation race condition