[NETFILTER]: nf_nat: don't add NAT extension for confirmed conntracks