kernel-config: Explicitly enable CONFIG_NETFILTER

This is needed by the NixOS firewall, but isn't enabled by the ARM
defconfig nor kernelAutoModules (as 'm' doesn't seem to be an option)

pkgs/os-specific/linux/kernel/common-config.nix

···
   ${optionalString (versionOlder version "3.13") ''
     IPV6_PRIVACY y
   ''}
+  NETFILTER y
   NETFILTER_ADVANCED y
   IP_ROUTE_VERBOSE y
   IP_MROUTE_MULTIPLE_TABLES y