MARK migrated to ipset

If port type in 'ports' begins with '0x', include this port in
special ipset, named 'mark_PROTO_MARK'. These ipsets then used
to group iptables by mark value. Port type 'mark' in 'ports' is
assumed.