ipfilter: Avoid allocating a new ipf token when not needed

Only allocate a new ipftoken_t if one cannot be found. This eliminates
allocating unnecessary token structures that will never be used when
performing simple lookups for existing token structures.

(cherry picked from commit 7f5e3b9fa3d159b7f061b4d01a767cbe5d0527f3)