netfilter: nft_tunnel: restrict it to netdev family