netfilter: xtables: add cluster match