Do userland filtering if we can't do kernel filtering.

If, for example, the filtering doesn't pass the kernel's filter
validator because it does backward branching, as would be the case if
"ip protochain" or "ip6 protochain" were used, we don't want to fail, we
want to fall back on filtering in userland.

Use some PCAP_ERROR_ values while we're at it, to match what pcap-bpf.c
does.