iptables: Update to version 1.8.11

iptables: Update to version 1.8.11

- Update from version 1.8.10 to 1.8.11
- Update of rootfile not required
- Changelog
    1.8.11
	new features:
		- New arptables-translate tool
		- ebtables-nft:
		  - Support for --change-counters command, albeit not atomic
		  - Specify rule counters using iptables' '-c N,M' syntax
		  - Support --replace and --list-rules commands
		  - Support zeroing individual rules
		  - Print negations (exclamation marks) extrapositioned (i.e., before
		    the match they invert) for consistency with iptables
		- iptables-translate:
		  - Align protocol name lookups with iptables
		  - iptables-translate: Support socket match and TPROXY target
		  - iptables-translate: Slightly improved avoidance of redundant 'ip
		    protocol'/'meta l4proto' matches
		- iptables:
		  - Undo numeric protocol printing of v1.8.9 for well-known protocols
		    for consistency with iptables-save
		  - Enable implicit extension lookup for dccp and ipcomp protocols (so
		    no extra '-m <proto>' is needed after '-p <proto>')
		- iptables-save: Avoid calls to getprotobynumber() for consistency and
		  improved performance with huge rule sets
		- libxtables: Support use of both xtables_ipaddr_to_numeric() and
		  xtables_ipmask_to_numeric() as parameters to the same function call
		- configure: Support disabling use of libnfnetlink
		- Prefix xtables-monitor rule events by a typical command (iptables,
		  ip6tables) instead of -4/-6 flags for consistency with ebtables and
		  arptables events
	fixes:
		- arptables-nft:
		  - Ineffective masks when specified in --h-type, --opcode and
		    --proto-type matches
		  - Wrong formatting of --h-type values and --proto-type masks causing
		    misinterpretation by  arptables-restore
		- iptables-nft:
		  - Wrong error messages in corner-case error conditions
		  - Zeroing single rule counters broken (again!)
		  - Incorrect combination of inverted payload matches
		  - Spurious error when zeroing a specific builtin chain which doesn't
		    exist - Calling -Z command with bogus rule number must fail
		- libiptc: Corner-case segfault upon renaming a chain
		- ebtables-restore:
		  - Corner-case bug with --noflush
		  - Spurious failures when deleting multiple rules with among matches
		- ebtables-nft:
		  - Different line number (--Ln) formatting than ebtables-legacy
		  - Off-by-one rule number when using -S command with rule number
		- iptables-legacy: Broken --wait without timeout
		- libxtables: Leak of matches' udata buffer
		- Some matches stripped full value ranges from output even if inverted
		- Illegal memory access when parsing '-c ""' (i.e., empty string
		  argument)
		- Inverted full interface wildcards (e.g. '! -i +') stripped from
		  iptables-save output
		- xtables-monitor:
		  - Incorrect output when not called with -4 or -6 options
		  - Flush stdout after each line to prevent buffers and help with
		    scripting
		  - Align output for builtin chains with that of tables
		  - Capture arptables chain events, too
		  - Empty 'EVENT:' lines printed for ebtables rule changes
		- Fix for compiling against musl libc
		- xtables-translate: Fix translation of TPROXY target
	documentation updates:
		- Extensions: string: Starting with linux-6.7, pattern matching no
		  longer extends past 'to' offset - update the man page accordingly
		- Extensions: recent: Clarify ip_list_hash_size default value and
		  obsoleted state of ip_pkt_list_tot
		- ebtables-nft.8: Note that --concurrent is a NOP
		- Misc. typesetting, spelling and grammar fixes in man pages

Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Reviewed-by: Michael Tremer <michael.tremer@ipfire.org>
Signed-off-by: Arne Fitzenreiter <arne_f@ipfire.org>