nftables-ctl: only use rules with the rules extension