[ upstream commit 3c3b908d ]

This revalidation is only required in the IPv4 path, while
ipv6_local_delivery() doesn't take an `ip6` parameter.

Signed-off-by: Julian Wiedmann <jwi@isovalent.com>

[ upstream commit 88e28e1 ]

This effectively restores HostFw for WireGuard.
Prior to this, we were erroneously always returning to the stack all
packets destined for local host, skipping the HostFw policies if enabled.

With this patch, packets for local host will always be delivered to
cilium_net@egress, similarly to what we do in bpf_overlay after decap.
With HostFw enabled, the to-host program in `cilium_host@ingress` will
then enforce policies.

This patch does not affect packets for local endpoint:
* With BPF Host Routing: will be directly delivered to the pod, tail
  calling into its ep->lxc_id function to enforce ingress policies.
* Without BPF Host Routing: will return to stack, which then goes to its
  to-container installed program to match ingress policies.

Trying to pull-in the whole `host_firewall.h` and `policy.h` would require
to set bpf_wireguard similarly as we do for bpf_host, meaning assigning
an endpoint ID, otherwise host policies would block all host related
packets (ep id == 0). For this reason, we decide here to go through cilium_host.

From a bpf test perspective:
* no changes for packet to/from local endpoint INGRESS/EGRESS
* no changes for packet from local host EGRESS
* packet to local host INGRESS: differently than bpf_host, in WireGuard
                                we always redirect to cilium_host@ingress.

While fixing this bits, let's move the superfluous `revalidate_data`
post NodePort inside the NodePort code, as not needed otherwise.

Signed-off-by: Simone Magnani <simone.magnani@isovalent.com>