netfilter: nft_limit: allow to invert matching criteria