bpf: cgroup inet skb programs can return 0 to 3