Change iptables fwmark to use single configurable bit instead of whole mark space

hack/verify-flags/known-flags.txt

@@ -148,6 +148,7 @@ input-dirs
 insecure-bind-address
 insecure-port
 insecure-skip-tls-verify
+iptables-masquerade-bit
 iptables-sync-period
 ir-data-source
 ir-dbname