Don't arbitrarily limit set_mark to certain chains

set_mark is currently limited to PREROUTING or OUTPUT chain, i.e. something like the following isn't accepted:

```puppet
    firewallchain { 'from_mesh:mangle:IPv4':
        ensure  => present,
    }

    firewall { '900 mark mesh to vpn traffic':
        table           => 'mangle',
        chain           => 'from_mesh',
        proto           => 'all',
        jump            => 'MARK',
        set_mark        => '0x2342/0xffffffff',
    }
```

... however it's perfectly valid wrt. iptables.