core: Open netfilter socket only when needed

core: Open netfilter socket only when needed

On initrds where nfnetlink module is missing, trying to open
a NETLINK_NETFILTER netlink socket takes a lot of time then fails.
This makes boot noticibly slower. Even though probably no
unit in an initrd need netfilter.

So here we delay opening the socket until we know we need it.