Complexity issue on 5.10+ with kubeProxyReplacement=disabled

[pchaigno]

Disabling the kube-proxy replacement on net-next results in complexity issues for the IPv4 path of bpf_lxc:

level=error msg="Command execution failed" cmd="[tc filter replace dev lxcd7934e21d6b8 ingress prio 1 handle 1 bpf da obj 1885_next/bpf_lxc.o sec from-container]" error="exit status 1" subsys=datapath-loader
[...]
level=warning msg="Prog section '2/7' rejected: Argument list too long (7)!" subsys=datapath-loader
level=warning msg=" - Type:         3" subsys=datapath-loader
level=warning msg=" - Attach Type:  0" subsys=datapath-loader
level=warning msg=" - Instructions: 3307 (0 over limit)" subsys=datapath-loader
level=warning msg=" - License:      GPL" subsys=datapath-loader
level=warning subsys=datapath-loader
level=warning msg="Verifier analysis:" subsys=datapath-loader
level=warning subsys=datapath-loader
[...]
level=warning msg="BPF program is too large. Processed 1000001 insn" subsys=datapath-loader

An example can be found at https://jenkins.cilium.io/job/Cilium-PR-K8s-1.13-net-next/556/testReport/Suite-k8s-1/13/K8sDatapathConfig_Encapsulation_Check_connectivity_with_transparent_encryption_and_VXLAN_encapsulation/.
Sysdump:
b91bb5b3_K8sDatapathConfig_Encapsulation_Check_connectivity_with_transparent_encryption_and_VXLAN_encapsulation.zip
(IPSec is enabled in this example but it doesn't make a difference.)

This is closely related to #14234.