fix: reject invalid network ls filters

[immanuwell]

network ls --filter names=missing lists every configured network

This rejects unknown keys and filters without =, valid name and label filters still work

Repro with CNI plugins installed:

nerdctl network create repro-net
nerdctl network ls --filter names=missing

Before: lists repro-net. After: exits with invalid filter 'names'

Tested: make test-unit and golangci-lint run ./pkg/cmd/network/...