This commit removes the !changes.Empty() condition to avoid the bug when
the bpf map is no change but we still need to update the envoy network
policy and add the version validation in 1.18

When there is SNI network policy with FQDN network policy, we will
redirect egress all traffic to the envoy.  The identity could change
with wildcard FQDN policy and bpf map will keep the same. that will
cause the enovy network policy not getting updated.

For example,we could have the following identities in the beginning

1677721   fqdn:sts.*.amazonaws.com
           reserved:world
16777220   fqdn:*.amazonaws.com
           reserved:world

When the DNS resolves the IP for sts.*.amazonaws.com, we will generate
the new identity

16777223   fqdn:*.*.amazonaws.com
           fqdn:sts.*.amazonaws.com
           reserved:world

If we have the SNI network policy for the pod, that will make the bpf
map look like the following.

root@kind-worker8:/home/cilium# cilium bpf policy get 2782
POLICY   DIRECTION   LABELS (source:key[=value])
PORT/PROTO   PROXY PORT   AUTH TYPE   BYTES   PACKETS   PREFIX   LEVEL
Allow    Ingress     ANY
ANY          NONE         disabled    0       0         0        0
Allow    Ingress     reserved:host
ANY          NONE         disabled    0       0         0        0
Allow    Egress      ANY
443/TCP      13379        disabled    5904    33        24       0

With the current check logic, there is no change to the map. Then we
will skip updating the envoy network policy causing envoy holding the
stale identity and block the traffic.

Signed-off-by: Liyi Huang <liyi.huang@isovalent.com>