netfilter: x_tables: make sure e->next_offset covers remaining blob size