Multi-Pool IPAM is compatible with IPsec encryption only when running in tunnel mode (see #39442).

To make Multi-Pool and IPsec compatible with native routing mode too, we need to handle each additional SecondaryCIDRs of the CiliumNodes, installing the proper XFRM policies and states. Doing that guarantees the correct encryption of the egress traffic toward pods with addresses carved out of non-default IP pools.

At the moment, the traffic is dropped by the XFRM framework and the related stat XfrmOutPolBlock is increased each time.