connmark: Consider configured mask in installed firewall rules

connmark: Consider configured mask in installed firewall rules

This allows using the upper parts of the marks for other purposes.  For
instance, with `mark_in=mark_out=%unique/0x0000ffff` mark values in the
upper two bytes would not get reset by the rules installed by this plugin.
However, note that in this example the daemon would have to get restarted
after 65'535 CHILD_SAs to reset the counter for unique marks, which is a
global 32-bit counter that's unaware of any masks.

Closes strongswan/strongswan#1087