xfrm: fix rcu usage in xfrm_get_type_offload

request_module can sleep, thus we cannot hold rcu_read_lock() while
calling it. The function also jumps back and takes rcu_read_lock()
again (in xfrm_state_get_afinfo()), resulting in an imbalance.

This codepath is triggered whenever a new offloaded state is created.

Fixes: ffdb5211 ("xfrm: Auto-load xfrm offload modules")
Reported-by:  <syzbot+ca425f44816d749e8eb49755567a75ee48cf4a30@syzkaller.appspotmail.com>
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>