conntrack extensions are free'd via kfree_rcu, but there appears to be no need for this anymore.
Lookup doesn't access ct->ext. All other accesses i found occur after taking either the hash bucket lock, the dying list lock, or a ct reference count. Only exception was ctnetlink, where we could potentially see a ct->ext that is about to be free'd via krealloc on other cpu. Since that only affects unconfirmed conntracks, just skip dumping extensions for those.
