net/mlx5: limit flow API rules to one tunnel