v26.11

NEWS:
  - nft: filter out more bad TCP flags
  - metrics: add historgram for sets

CHANGES:
  - nft: check bad tcp flags before conntrack
  - ingress: be less restrictive for additional ports

FIXES:
  - nft: fix rule 2+3: block an address for 24h after the *last* rule violation, not the first