raw ip: merge rip_output() into rip_send()

While here, address the unlocked 'dst' read. Solve that by storing
a pointer either to the inpcb or to the sockaddr. If we end up
copying address out of the inpcb, that would be done under the read
lock section.

Reviewed by: melifaro
Differential revision: https://reviews.freebsd.org/D36127