`MapState` has many methods, some of which are public.
In order to keep state to accomplish creating a cohesive
map state that can keep state besides what will be put into
an ebpf map, `MapState` can no longer be a type declaration
for a golang map, but must be a struct that keeps state.

The endpoint package must also be refactored to use `MapState`
as an interface rather than a instantiated type of a map.

Now that mapState is a struct, we can split the tracking of allows and
denies. This commit should not introduce functional changes, but
prepares us for an optimization in a later commit.

Since the denyPreferredInsert logic cleanly splits on whether the to be
inserted entry is a deny entry, we can avoid iterating over some
entries: If we are inserting a deny, we are mostly interested in
iteration over existing allows, and vice versa.

In the case where we have a FQDN policy for a hostname which resolves to
many IPs (for example with a fqdn policy covering Amazon's S3), this
becomes a hot function (without performing a lot of useful work). The S3
workload is expected to be heavily skewed towards allow entries for the
many CIDR identities allocated for S3. When we insert such an entry, we
only need to iterate deny entries, of which there are expected to be
much fewer. Now that the tracking is split, we can employ this fact and,
instead of iterating all entries, iterate only the deny entries.