pflua-match: Work on arrays of packets, not pointers

This change makes the filter function much tidier, but massively increases performance variance on small data sets (it evens out on larger ones). It retains the property of having no CNEWI calls, as does the sink_cnewi branch, but not master.