netfilter: xt_TCPMSS: add more sanity tests on tcph->doff