xtables: delay (statically built) match/target initialization

xtables: delay (statically built) match/target initialization

Matches and targets built into the iptables static binary will always
be registered as the binary starts up, this may potentially (as a result
of kernel version support checking) result in modules being autoloaded.

This is undesirable (for example it may cause CONNMARK target to load
and thus cause the kernel to load the conntrack module, which isn't a
no-op).

Transition to a system where matches and targets are registered into
a pending list, from whence they get fully registered only when
required.

Signed-off-by: Maciej Zenczykowski <maze@google.com>
Signed-off-by: Patrick McHardy <kaber@trash.net>