bpf: l3: restore MARK_MAGIC_PROXY_INGRESS for from-proxy traffic

[julianwiedmann]

With #29530 in place, we now also
divert proxy traffic to cilium_host when per-EP routes are enabled. But we
potentially still need to deliver this traffic to a local endpoint - say
for a pod-to-pod connection on the same node, with L7 proxy inbetween.

In a configuration with per-EP routes but no BPF Host-Routing,
l3_local_delivery() transfers the source identity to the skb->mark and
redirects to bpf_lxc, where the to-container program handles the packet.

If we transfer the packet with MARK_MAGIC_IDENTITY, to-container will
look up the network policy and redirect to the L7 proxy again. Thus we
need to fully restore the proxy's actual mark, so that to-container's
inherit_identity_from_host() call finds the expected magic ID. It then
sets the TC_INDEX_F_FROM_INGRESS_PROXY flag, and skips the redirect to
L7 proxy.

[julianwiedmann]

/test

[jschwinger233]

Not within scope of this PR, just want to say variable name magic is magic 🪄
However I can't think of any better idea either