netfilter: on sockopt() acquire sock lock only in the required scope