netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check()