netfilter: nft_ct: reject direction for ct id