netfilter: ipset: fix performance regression in swap operation

In the Linux kernel, the following vulnerability has been resolved:

netfilter: ipset: fix performance regression in swap operation

The patch "netfilter: ipset: fix race condition between swap/destroy

and kernel side add/del/test", commit 28628fa9 fixes a race condition.

But the synchronize_rcu() added to the swap function unnecessarily slows

it down: it can safely be moved to destroy and use call_rcu() instead.

Eric Dumazet pointed out that simply calling the destroy functions as

rcu callback does not work: sets with timeout use garbage collectors

which need cancelling at destroy which can wait. Therefore the destroy

functions are split into two: cancelling garbage collectors safely at

executing the command received by netlink and moving the remaining

part only into the rcu callback.