This commit adds a catch-all XFRM policy for outgoing traffic that has the
encryption bit. The goal here is to catch any traffic that may passthrough
our encryption while we are replacing XFRM policies & states. Those
operations cannot always be performed atomically so we may have brief
moments where there is no XFRM policy to encrypt a subset of traffic. This
policy ensures we drop such traffic and don't let it flow in plain text.

We do need to match on the mark because there is also traffic flowing
through XFRM that we don't want to encrypt (e.g., hostns traffic).

Signed-off-by: Paul Chaignon <paul@cilium.io>

We recently changed our XFRM states and policies (IPs and marks). We
however failed to remove the stale XFRM states and policies and it turns
out that they conflict (e.g., the kernel ends up picking the stale
policies for encryption instead of the new one).

This commit therefore cleans up those stale XFRM states and policies. We
can identify them based on mark values and masks (we switched from
0xFF00 to 0XFFFFFF00).

The new XFRM states and policies are added as we receive the information
on remote nodes. By removing the stale states and policies before the
new ones are installed for all nodes, we could cause plain-text traffic
on egress and packet drops on ingress.

To ensure we never let plain-text traffic out, we will clean up the
stale config only once the catch-all default-drop policy is installed.
In that way, if there is a brief moment where, for a connection
nodeA -> nodeB, we don't have a policy, traffic will be dropped instead
of sent in plain-text.

For each connection nodeA -> nodeB, those packet drops on egress and
ingress of nodeA will happen between the time we replace the BPF
datapath and the time we've installed the new XFRM state and policy
corresponding to nodeB. Waiting longer to remove the stale states and
policies doesn't impact the drops as they will keep happening until the
new states and policies are installed. This is all happening on agent
startup, as soon as we have the necessary information from k8s.

Signed-off-by: Paul Chaignon <paul@cilium.io>