Turns out some combination of ebtables userspace and kernel doesn't
respect the --stp-type matcher.  So just drop all forwarded packets
destined to the bridge group address.

Anyway, this STP-less firewall bridge should be a better fit for most
switches.