CVE-2026-98793: netfilter: bpf: reject invalid NAT manipulation types

In the Linux kernel, the following vulnerability has been resolved:

netfilter: bpf: reject invalid NAT manipulation types

As bpfctsetnatinfo() is not validating the NAT manipulation type a wrong value can be passed directly to nfnatsetupinfo(). This triggers the WARNON() at nfnatsetupinfo() and if paniconwarn isn't set, then IPSSRCNATDONE is set without adding natbysource and conntrack cleanup tries to unlink an uninitialized hlist node.

Fix this by checking that NAT manipulation type is correct before calling nfnatsetupinfo(). In addition, if the WARNON is hit, return NFDROP instead of continuing with the processing to avoid similar situations in the future.