netfilter: nf_tables: restrict tunnel object to NFPROTO_NETDEV