netfilter: ctnetlink: honor CTA_MARK_MASK when setting ctmark