firewall: T3900: fix migration and smoketests

Commit 770edf016838523 ("T3900: T6394: extend functionalities in firewall")
changed the position in the CLI for conntrack timeout. This lead to failing
smoketests because of a regression in the migrator.

(cherry picked from commit 2cbc4eb005fc936e37a34a1ef539d164f21f90b5)