xfrm: state: reject mark with bits outside its mask on ALLOCSPI

Like state add and policy add in this series, ALLOCSPI rejects a mark
whose value has bits outside its mask.

Fixes: bd55775c8dd6 ("xfrm: SA lookups signature with mark")
Cc: <stable+noautosel@kernel.org> # avoid breaking existing userspace ABI
Signed-off-by: Antony Antony <antony.antony@secunet.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>