netfilter: nf_tables: match on tunnel metadata