netfilter: bridge: confirm multicast packets before passing them up the stack