Change userspace LIFETIME matching to match APF filter generation

Reading the byte values and handling the cases similarly to
Ra#generateFilterLocked() makes the code easier to reason about, since
the functionality must always be equivalent.

Test: atest ApfTest
Change-Id: I6a8068265ca58cb80f256d86a03e6a1144b297d0