netfilter: nat: use keyed locks