connmark: Add CONNMARK rules to select correct output SA based on conntrack