netfilter: nf_conncount: move all list iterations under spinlock