netfilter: bridge: rework reject handling