Fix rt_setgate() error handling.

Fix rt_setgate() error handling.

In revision 1.424 the logic in rt_setgate() has changed.  The old
code entered a value into rt_gateway also if rt_setgwroute() returned
an error.  Now if rt_setgwroute() fails, rt_gateway is NULL and
ROUNDUP(rt->rt_gateway->sa_len) crashes.

Put back the old logic in rt_setgate().  Setting rt_gateway and
rt_gwroute are actually independent.

If malloc(9) in rt_setgate() fails, rt_gateway can still be NULL.
The subsequent crash in free(rt->rt_gateway, M_RTABLE,
ROUNDUP(rt->rt_gateway->sa_len)) was just never observed.  Add a
NULL check around these free(9).

Reported-by: syzbot+2e79dd9db712d3c5ade9@syzkaller.appspotmail.com
OK mvs@