Fix two more locking bugs in the NDP code:

1. When deleting an IPv6 address from an interface, we would take a
   reference to its prefix without bumping it and later check if it is
   zero, all without any locking. Instead, bump the refcount before
   calling in6_purgeaddr and use atomic_fetchadd_int to determine
   whether or not the prefix should be freed. The alternative was to
   essentially wrap the entire case with the ND_WLOCK, but that's ugly
   IMO.

   In the current code, there are two races: if two users try to delete
   the same address, one thread could check if pr->ndpr_refcount == 0
   after the other thread had freed the prefix, resulting in a
   use-after-free. If two users try to delete different addresses with
   the same prefix (so that the refcount is 2), both threads could
   decrement the refcount before either thread compares it to 0, thus
   resulting in a double free.

2. When flushing the prefix list, prefix_onlink_check() could be called
   with the NDP wlock held, causing an assertion failure since this
   function acquires the NDP rlock.