netfilter: snat: evict closing tcp entries on reply tuple collision