Per-interface list of addresses, both multicast and unicast, are

Per-interface list of addresses, both multicast and unicast, are
currently protected by the NET_LOCK().

They are not accessed in the hot path, so protecting them with a
mutex could be an option.  However since we're now going to run
with a NET_LOCK() for some time, assert that it is held.

IPsec is not yet ready to run without KERNEL_LOCK(), so assert it
is held, even in the forwarding path.

Tested by sthen@, ok visa@, claudio@, bluhm@