rules: fix leak on failure

matcher_match() builds up the kccgst's, and we steal the memory on
success. But on error we didn't free it.

Signed-off-by: Ran Benita <ran234@gmail.com>