netfilter: nf_conntrack: restrict NAT helper invocation to IPv4