netfilter: xtables: avoid percpu ruleset duplication