Background:
In #31082 we fixed the unnecessary tracking of node-to-node traffic by the SNAT engine, when dealing with Cilium's overlay traffic. This was causing occasional SNAT failures for new connections, as the SNAT engine was unable to reserve a free source port on apparent port "conflicts".

It's likely that we have similar scenarios for other types of traffic (Wireguard? DSR?) when they pass through to-netdev.

Proposal:
Implement similar SNAT avoidance schemes for other types of traffic. One way of finding such traffic patterns is using the SNAT utilization metric, introduced by #32152. Ideally we would also add regression testing for those traffic patterns.