net/mlx5: switch encap rules to use container