tunnel: set skb mark for IPsec tunnel packets