luci-app-firewall: allow negative prefix lengths