netfilter: nf_conntrack: add support for "conntrack zones"