tunnel: add cli support for encap_decap flags