Reworked packet/connection marking (#170)

Reworked packet/connection marking (#170)

The handling of packet and connection marks was odd: The clientside_mark
ACL worked with connection marks, but the directive of the same name
supported only packet marks. Also, clients packet MARK (if set)
overwrote CONNMARK and, as a result, broke ACL checking.

To minimize confusion, connection and packet marks are now separated:

    * renamed the clientside_mark ACL to client_connection_mark
    * renamed the clientside_mark directive to mark_client_packet
    * added a mark_client_connection directive

While the first two points just clarify things, the last one introduces
a new functionality: It allows to set or change clients CONNMARK.

Both clientside_mark ACL and directive are now deprecated.