flow: Use bit-mask for IP protocol match, instead of FWW_* flag.