netfilter.mk: use CONFIG_NETFILTER_XT_TARGET_MASQUERADE