gnu: nftables: Prefer mirror://netfilter sources.