Consistently log XFRM mark masks with 0 prefix in kernel-netlink plugin