[PATCH 6.6 43/54] netfilter: nft_socket: make cgroupsv2 matching work with namespaces