net/sfc: fix outer rule and encap rollback on error