Attach HFSC after it's been completely initialized.

This fixes the "integer divide fault trap" bug caused by the second malloc
skipping a beat and leaving the amount of allocated queues equal to zero.

tested by me, ok henning mikeb
suppress spurious error message when loading key with a passphrase;
reported by kettenis@ ok markus@
Merge two loops in collapse_redirspec into one

This lets us do the checks only once and also make smarter decisions
about the rule's own address family.  As a result af-to rules no longer
need to specify the address family after 'pass'.

ok henning
fix the identical leak in three different files.
reported by Brent Cook, original diff by logan
simplify and unobfuscate a variable to fix a mem leak.
original diff by logan