selinux: handle TCP SYN-ACK packets correctly in selinux_ip_output()