net/sfc/base: support MARK and FLAG actions in filters