netfilter: x_tables: validate e->target_offset early