Support --filter-mark mark/[/mask]

[jschwinger233]

Currently --filter-mark accepts mark value only which is interpreted into value/0xffffffff. I found it helpful to support mask such as 0xa00/0xf00 in order to match 0xe1300a00.

One real world use case is to match packets from Cilium L7 proxy in forward direction, whose skb mark is 0xa00 | cluster_id <<12 | sec_id <<16 (like 0xe1330a00).

If mask is not provided, e.g. --filter-mark 0xa00 should be seen as 0xa00/0xfffffff.