A service provider is deploying RSVP-TE tunnels and wants a specific tunnel to traverse only links that are colored as 'high-bandwidth' (bit 0x01) while avoiding any link colored as 'satellite' (bit 0x04). The core links have their attribute-flags configured accordingly. Which tunnel configuration correctly enforces this path constraint using affinity and mask values?