luci-app-firewall: support 'MARK' action and matches for rules