how are the second (VPN) labels in the label stack propagated from the egress PE router to the ingress PE router?