zones: apply tcp mss clamping also on ingress path