netfilter: conntrack: convert to refcount_t api