dissector: display packet direction for tap'ing on netlink devices (nlmon)

Linux kernel provides nlmon device (ARPHRD_NETLINK) driver that
can tap on netlink traffic, e.g.:

Setup:
  modprobe nlmon
  ip link add type nlmon
  ip link set nlmon0 up

Capture:
  netsniff-ng -i nlmon0 ... (or -i any)

Teardown:
  ip link set nlmon0 down
  ip link del dev nlmon0
  rmmod nlmon

Provide information about the packet direction (user space or kernel
space), so that dissector will show that properly.

Signed-off-by: Daniel Borkmann <dborkman@redhat.com>