xtables: Free chains in NFT_COMPAT_CHAIN_ADD jobs

xtables: Free chains in NFT_COMPAT_CHAIN_ADD jobs

Chains in NFT_COMPAT_CHAIN_ADD usually have to be freed because they are
not added to the cache.

There is one exception though, namely when zeroing counters:
nft_chain_zero_counters() adds a chain object it took from chain cache.
To distinguish this situation from the others, introduce
NFT_COMPAT_CHAIN_ZERO batch object type, which is treated just like
NFT_COMPAT_CHAIN_ADD but batch_obj_del() does not free it's chain.

Signed-off-by: Phil Sutter <phil@nwl.cc>
Signed-off-by: Florian Westphal <fw@strlen.de>