vici: Make in-/outbound marks the SA should set configurable