This commit introduces the logic to match WireGuard traffic, mainly for
tracing. A packet is classified as belonging to a WireGuard communication
in Cilium if all the following conditions hold true:

1. UDP packet           -- non UDP cannot be WireGuard.
2. L4 dport == WG_PORT  -- the destination is for WG_PORT, could be related
                           to a cilium-managed WireGuard communication.
3. L4 sport == dport    -- also the sender is using WG_PORT, could be
                           originated by a cilium node.
4. Identity in cluster  -- the sender is a valid node within the cluster
                           now we now for sure that is a WG-valid packet.

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>

This commit refactors the tracing of the packets in the `do_netdev` function.
Before this commit, we always trace the packet with an unknown src identity.
Since few lines of code later we retrieve this value in case of an IPv4/6
packet, it makes sense to use it also while tracing the packet
so that we provide a bit more context. An example of output after applying
this patch would be as follows (no encryption, native routing):

```bash
1:<- endpoint 2223 flow 0x0 , identity 2173->unknown state unknown ifindex 0 orig-ip 0.0.0.0: 10.244.3.213 -> 10.244.1.98 EchoRequest
2:-> stack flow 0x0 , identity 2173->13606 state new ifindex 0 orig-ip 0.0.0.0: 10.244.3.213 -> 10.244.1.98 EchoRequest
3:-> 0: 10.244.3.213 -> 10.244.1.98 EchoRequest
4:<- network flow 0x0 , identity 13606->unknown state unknown ifindex eth0 orig-ip 0.0.0.0: 10.244.1.98 -> 10.244.3.213 EchoReply
5:<- host flow 0x0 , identity 13606->unknown state unknown ifindex eth0 orig-ip 0.0.0.0: 10.244.1.98 -> 10.244.3.213 EchoReply
6:-> endpoint 2223 flow 0x0 , identity 13606->2173 state reply ifindex lxcf91eb0f2f0ab orig-ip 10.244.1.98: 10.244.1.98 -> 10.244.3.213 EchoReply
```

We can now see in line 4 the source identity while logging the packet.

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>

This commit adds logic to trace ingress WireGuard packets with the
TRACE_REASON_ENCRYPT. The reason is to have an aligned behavior similarly
to IPSec, for which we inspect and check whether the packet is ESP and mark
it for decryption. Within WireGuard, we just need to check that it is a
valid WireGuard packet for and from a cilium-managed endpoint and trace it
accordingly without having to use ctx->mark. An example output would look
as follows:

```bash
1:<- endpoint 321 flow 0x0 , identity 41978->unknown state unknown ifindex 0 orig-ip 0.0.0.0: 10.244.2.90 -> 10.244.1.17 EchoRequest
2:-> stack flow 0x0 , identity 41978->26105 state new ifindex 0 orig-ip 0.0.0.0: 10.244.2.90 -> 10.244.1.17 EchoRequest
3:-> 0: 10.244.2.90 -> 10.244.1.17 EchoRequest
4--> network flow 0x0 , identity unknown->unknown state new ifindex eth0 orig-ip 0.0.0.0: 172.18.0.4:51871 -> 172.18.0.2:51871 udp
5-<- network encrypted  flow 0x0 , identity remote-node->unknown state new ifindex eth0 orig-ip 0.0.0.0: 172.18.0.2:51871 -> 172.18.0.4:51871 udp
6:<- host flow 0x0 , identity 26105->unknown state unknown ifindex cilium_wg0 orig-ip 0.0.0.0: 10.244.1.17 -> 10.244.2.90 EchoReply
7:-> endpoint 321 flow 0x0 , identity 26105->41978 state reply ifindex lxceef65ccc7619 orig-ip 10.244.1.17: 10.244.1.17 -> 10.244.2.90 EchoReply
```

Note how in line 5 the FROM_NETWORK packet is marked as `encrypted`.

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>

This commit modifies the `trace.reason` in the egress path of a WireGuard
encrypted packet, to trace it with TRACE_REASON_ENCRYPT.
An example output would look as follows:

```bash
1:<- endpoint 321 flow 0x0 , identity 41978->unknown state unknown ifindex 0 orig-ip 0.0.0.0: 10.244.2.90 -> 10.244.1.17 EchoRequest
2:-> stack flow 0x0 , identity 41978->26105 state new ifindex 0 orig-ip 0.0.0.0: 10.244.2.90 -> 10.244.1.17 EchoRequest
3:-> 0: 10.244.2.90 -> 10.244.1.17 EchoRequest
4--> network encrypted flow 0x0 , identity unknown->unknown state new ifindex eth0 orig-ip 0.0.0.0: 172.18.0.4:51871 -> 172.18.0.2:51871 udp
5-<- network encrypted  flow 0x0 , identity remote-node->unknown state new ifindex eth0 orig-ip 0.0.0.0: 172.18.0.2:51871 -> 172.18.0.4:51871 udp
6:<- host flow 0x0 , identity 26105->unknown state unknown ifindex cilium_wg0 orig-ip 0.0.0.0: 10.244.1.17 -> 10.244.2.90 EchoReply
7:-> endpoint 321 flow 0x0 , identity 26105->41978 state reply ifindex lxceef65ccc7619 orig-ip 10.244.1.17: 10.244.1.17 -> 10.244.2.90 EchoReply
```

Note how also in line 4 the TO_NETWORK packet is marked as `encrypted`.

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>