netfilter: xt_connbytes: handle negation correctly