netfilter: xtables: switch hook PFs to nfproto