netfilter: nft_payload: work around vlan header stripping