With eff26cf ("datapath: Fix double SNAT") the outbound SNAT path now
sets ctx_snat_done_set() after checking whether a packet requires SNAT.
This was meant to avoid double-NATing when a packet passes through multiple
network interfaces with a to-netdev program.

But looking at the SNAT code in detail, some of its conditions only apply
on specific interfaces (see nodeport_has_nat_conflict_ipv4(), which
checks for `NATIVE_DEV_IFINDEX == DIRECT_ROUTING_DEV_IFINDEX`). So if a
packet passes through multiple interfaces which all have `to-netdev`
attached, the first `to-netdev` program might set SNAT_DONE even when some
subsequent program (attached to DIRECT_ROUTING_DEV_IFINDEX) would still
want to apply SNAT to the packet.

Therefore we should apply the SNAT checks on *each* interface, until we
have actually SNATed the packet. Only then set the SNAT_DONE marker.

Note that this also fixes an EgressGW bug in nodeport_snat_fwd_ipv4(),
where we would redirect the packet even if snat_v4_nat() reported an error.

Fixes: eff26cf ("datapath: Fix double SNAT")

When using stacked network interfaces (such as br0 -> eth0) in the egress path, ensure that BPF SNAT checks are applied on all interfaces.