netfilter: nftables_offload: build mask based from the matching bytes