conntrack: enable support for netfilter conntrack zones