UPSTREAM: netfilter: x_tables: make sure e->next_offset covers remaining blob size

(cherry pick from commit 6e94e0cfb0887e4013b3b930fa6ab1fe6bb6ba91)

Otherwise this function may read data beyond the ruleset blob.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
Change-Id: I9d19ecf3e00a2d52817b35b9042623927895c005
Bug: 29637687