netfilter: nft_ct: sanitize layer 3 and 4 protocol number in custom expectations