gh/workflows: disable host routing instead of BPF masquerading

Host routing breaks testing in KIND clusters, see #23283. Instead
of disabling BPF masquerading, force legacy routing.

This will allow running egress gateway tests in CI, which require
BPF masquerading.

Signed-off-by: Lorenz Bauer <lmb@isovalent.com>

.github/workflows/conformance-datapath.yaml

@@ -226,7 +226,8 @@ jobs:
             --config monitor-aggregation=none \
             --nodes-without-cilium=kind-worker3 \
             --helm-set-string=kubeProxyReplacement=${{ matrix.kpr }} \
-            --helm-set=bpf.masquerade=false"
+            --helm-set=bpf.masquerade=true \
+            --helm-set=bpf.hostLegacyRouting=true"
           TUNNEL="--helm-set-string=tunnel=${{ matrix.tunnel }}"
           if [ "${{ matrix.tunnel }}" == "disabled" ]; then
             TUNNEL="--helm-set-string=tunnel=disabled --helm-set-string=autoDirectNodeRoutes=true --helm-set-string=ipv4NativeRoutingCIDR=10.244.0.0/16"