fix vlan insertion offset

l2_payload points to a buffer that is after the vlan header if present. push_vlan must be done at l2_vlan_header if present.