net: bridge: add per-port group_fwd_mask with less restrictions