ip6_output: fix memory leak on fast-send

When emitting NDP Neighbour Sollicitations, ip6_output immediately calls if_encap without going through any queue. if_encap however does not free the mbuf, so ip6_output has to do it.

This was leaking one mbuf per NDP NS sent by slirp. Hopefully the guest was not using more than NDP_TABLE_SIZE (16) IPv6 addresses, in which case it was limited to a bound number, but more addresses would result to leaks.