v1.54.0 — chain-not-in-table and target-not-valid-here

Two new error smells for rules written in the wrong place — iptables-restore refuses the file:

• chain-not-in-table — -A PREROUTING under *filter, -A FORWARD under *nat… each table has its own built-ins.
• target-not-valid-here — jumps to built-in chains; DNAT/SNAT/MASQUERADE/REDIRECT outside nat, REJECT outside filter, NOTRACK/CT outside raw, DROP in nat; NAT targets at the wrong hook, with user chains judged by every built-in that reaches them.

Measured with iptables 1.8.13 (nf_tables and legacy) and ip6tables, real loads. The detector also caught our own iptables-nat-state-dead sample, which never loaded (-j DROP in nat) — fixed. Two new samples. 65 smells, tests 341.