iptables: free xtables_match if found in need_protomatch