netfilter: evict stale entries when user reads /proc/net/nf_conntrack