common/cnxk: support tunnel header verification