tunnel: Clear IPSEC_MARK on input rather than output.