netfilter: conntrack: place 'new' timeout in first location too