[tamnd]

Part of #542.

This PR adds the stateful expressions of the sets of nf_tables, as nft_set_elem_expr_alloc of Linux.

• A set takes NFTA_SET_EXPR and NFTA_SET_EXPRESSIONS. An element takes NFTA_SET_ELEM_EXPR and NFTA_SET_ELEM_EXPRESSIONS. dynset takes NFTA_DYNSET_EXPR and NFTA_DYNSET_EXPRESSIONS.
• The expressions are counter, quota, limit and connlimit, two at most.
• Each element has its own state. It is a copy of the expressions of the set, or the expressions that the element gives with the same types.
• A lookup and a dynset run the expressions of the element that they find.
• The connlimit expression of nft_connlimit.c counts the connections that connection tracking still has.

Tests

The tests/shell dirs that the change touches: sets, maps, optimizations, nft-f, json and transactions. 222 tests.

The kernel of the tests/shell runs had this PR and the next one (nft-27: interval get, overlaps and concatenated ranges). A fault in my build script did not rebuild the kernel of this PR alone. The boot tests and the gate use this PR alone.

	ok	failed	dump-fail	timeout or hang	skipped
x86_64 (server1, 3 jobs)	183	21	12	2	4
arm64 (server2, 2 jobs)	176	21	12	9	4

• x86_64: the load average of server1 after the run was 0.04, 0.08, 0.08. The run used 3 of the 4 cores.
• arm64: the load average of server2 was 10.97, 11.29, 10.97 at the start and 8.39, 9.09, 10.61 at the end.
• The 7 more hangs on arm64 are tests that add many elements: sets/0011, 0012, 0013 and 0030, sets/0044interval_overlap_1, maps/0004interval_map_create_once_0 and nft-f/0011manydefines_0. They pass on x86_64. The arm64 guest runs in TCG and these tests take more than 300 seconds there.
• sets: 78 of 93 pass on x86_64. tools/nftables/report.md gives 61.
• transactions: 37 of 41 pass on x86_64. The report gives 34. transactions/0042_stateful_expr_0 now passes.
• json, maps, nft-f, optimizations and transactions: 105 of 129 pass on x86_64. Before this PR, 96 passed. No test that passed before fails now.
• Boot tests: cargo xtask boot-test inet passes. RK_AARCH64_TESTS=inet cargo xtask boot-test aarch64 passes: inet, inet with virtio-pci, and inet with virtio-pci behind a bridge. The load average of server2 was 9.00, 9.92, 11.39 at the start and 12.23, 11.54, 11.05 at the end.

The tests ran on the commit before the rebase onto 77bcfd9. The rebase changed only CHANGELOG.md.

The full gate did not run.