netfilter: xtables: slightly better error reporting

When extended status codes are available, such as ENOMEM on failed
allocations, or subsequent functions (e.g. nf_ct_get_l3proto), passing
them up to userspace seems like a good idea compared to just always
EINVAL.

Signed-off-by: Jan Engelhardt <jengelh@medozas.de>

diff --cc net/ipv4/netfilter/ipt_CLUSTERIP.c
Simple merge

diff --cc net/netfilter/xt_CONNSECMARK.c
Simple merge

diff --cc net/netfilter/xt_CT.c
Simple merge

diff --cc net/netfilter/xt_DSCP.c
Simple merge

diff --cc net/netfilter/xt_HL.c
Simple merge

diff --cc net/netfilter/xt_LED.c
Simple merge

diff --cc net/netfilter/xt_NFQUEUE.c
Simple merge

diff --cc net/netfilter/xt_RATEEST.c
Simple merge

diff --cc net/netfilter/xt_SECMARK.c
Simple merge

diff --cc net/netfilter/xt_cluster.c
Simple merge

diff --cc net/netfilter/xt_connbytes.c
Simple merge

diff --cc net/netfilter/xt_connlimit.c
Simple merge

diff --cc net/netfilter/xt_connmark.c
Simple merge

diff --cc net/netfilter/xt_conntrack.c
Simple merge

diff --cc net/netfilter/xt_dscp.c
Simple merge

diff --cc net/netfilter/xt_hashlimit.c
Simple merge

diff --cc net/netfilter/xt_helper.c
Simple merge

diff --cc net/netfilter/xt_limit.c
Simple merge

diff --cc net/netfilter/xt_quota.c
Simple merge

diff --cc net/netfilter/xt_rateest.c
Simple merge

diff --cc net/netfilter/xt_recent.c
Simple merge

diff --cc net/netfilter/xt_state.c
Simple merge

diff --cc net/netfilter/xt_statistic.c
Simple merge

diff --cc net/netfilter/xt_string.c
Simple merge

diff --cc net/netfilter/xt_time.c
Simple merge