v1.56.0

Two new error smells for matches that look fine and stop the file from loading:

• owner-match-not-valid-here — -m owner matches the local socket that sent the packet, so the kernel only allows it in OUTPUT/POSTROUTING. "Only root may reach the admin API" written as an INPUT rule takes the whole file down. A user chain is judged by the built-ins that reach it.
• string-match-incomplete — -m string without a pattern or without --algo bm|kmp (lower case: --algo BM is refused too).

Measured with iptables 1.8.10 and 1.8.13 (nf_tables and legacy agree), real loads. New sample iptables-owner-input.txt, refused as shipped and loading once fixed, now in the Load sample dropdown — and a new test fails if any shipped sample is missing from it. 69 smells, tests 357. (#79)