netfilter: nft_compat: restrict match/target protocol to u16