netfilter: nf_tables: avoid skb access on nf_stolen