net/sfc: validate match spec in MAE backend