netfilter: ctnetlink: fix conntrack creation race