[RHEL9 P1] netfilter: various backports from upstream

JIRA: https://issues.redhat.com/browse/RHEL-33469

This batch contains netfilter changes that are outside of nf_tables or bridge areas. I split them up to keep the batch size manageable.

Signed-off-by: Florian Westphal fwestpha@redhat.com