libpfctl: handle pfctl_do_ioctl() failures better

Ensure that we free nvlists and other allocations if pfctl_do_ioctl()
fails.

MFC after: 1 week
Sponsored by: Rubicon Communications, LLC ("Netgate")

(cherry picked from commit 498934c5ff51e6b0d3199db5d27ed11b1e8b9582)