frag6_slowtimo: push NET_LOCK into frag6_freef around icmp6_error.

frag6_slowtimo: push NET_LOCK into frag6_freef around icmp6_error.

icmp6_error() still probably needs the NET_LOCK, as the call chain
icmp6_error -> icmp6_reflect -> rt_match -> rt_clone -> rtrequest
is possible.

The fragment discard loop in frag6_slowtimo and the other
cleanup bits in frag6_freef do not require it however.  So
push the lock down into frag6_freef around icmp6_error.

Prompted by mpi.  Discussed with bluhm and kn.  Regress test help
by bluhm.  Additional testing by kn.

ok kn@ visa@ mpi@