netfilter: nf_tables: reject new basechain after table flag update