service: Always allocate higher ID for svc/backend

[brb]

Previously, it was possible that a backend or a service would get
allocated ID, which would be ID_backend_A < ID < ID_backend_B. This
could have happened after cilium-agent restart, as the nextID was not
advanced upon the restoration of IDs.

This could have led to situations in which the per-packet LB could
selected a backend which did not belong to a requested service when the
following was fulfilled in the chronological order:

1. Previously the same client made the request to the service and the
   backend with ID_x was chosen.
2. The service endpoint (backend) with ID_x was removed.
3. cilium-agent was restarted.
4. A new service backend which does not belong to the initial service
   was created and got the ID_x allocated.
5. The CT_SERVICE entry for the old connection was not removed by the CT
   GC.
6. The same client made a new connection to the same service from the
   same src port.

The above led the lb{4,6}_local() to select the wrong backend, as it
found the CT_SERVICE entry with the backend ID_x.

The advancement of the nextID upon the restoration only partly mitigates
the issue. The real fix would be to introduce a match map which key
would be (svc_id, backend_id), and it would be populated by the agent.
The lb{4,6}_local() routines would consult the map to detect whether the
backend belongs to the service.

[brb]

/test