nss: mark keg-only

Fixes #15283.