firewall: introduce drop_invalid option to allow disabling the invalid state match