Integrate user-defined BPF (sub)programs

[qdeslandes]

Allow users to provide pre-compiled BPF programs to perform filtering in-place of a rule in the generated BPF program.

For example:

chain ...
    rule
        ip6.addr ::1
        ACCEPT
    rule
        meta.program ~/bpf/test.o
        counter
        DROP

The custom BPF program would be called when the rule is processed and returned whether it matches the packet's data, the program would apply (or not) the verdict.