[NETFILTER]: Add iptables CONNMARK match+target

[NETFILTER]: Add iptables CONNMARK match+target

This is the first patch, adding something similar like nfmark, but on a
per-conntrack (as opposed to per-skb) level.  Very useful especially for
asymmatric routing in combination with MASQUERADE, as often found on
home DSL setups with dymamic IP address that also have e.g. a tunnel
device with static IP.

Signed-off-by: Henrik Nordstrom <hno@marasystems.com>
Signed-off-by: Harald Welte <laforge@netfilter.org>
Signed-off-by: David S. Miller <davem@davemloft.net>