netfilter.mk: extend nf_add macro to take a version dependency expression