Add fwmask to iprule for the WireGuard interface

The WireGuard interface has an FWMARK (0x1bd00) to make an ip rule to let the WireGuard traffic itself use the main table:

not from all fwmark 0x1bd00 lookup netbird

However we (OpenWRT) are using Policy based Routing with many more ip rules with fwmarks

To minimize the risk of interference with other fwmarks it would be nice if an fwmask was added to the iprule e.g.:

110:    not from all fwmark 0x1bd00/0x000fff00 lookup netbird