Fix L7 ingress proxy in endpoint routes mode

[joestringer]

Fix per-endpoint route mode with the cilium-health endpoint, and configure
it such that the daemon prefers to connect over IPv4 rather than IPv6 when
both protocols are enabled in the daemon. Otherwise we hit CI issues in
the endpoint routes mode datapath configuration test (See #8956).

Fix up the per-endpoint route mode tests so they actually test per-endpoint
routes in the supported direct routing mode rather than in tunnel mode.

Fix routing from a host proxy towards local pods in endpoint routes mode:

When endpoint routes are enabled, we don't need to install the ip rules
or routes to ensure that the traffic from the ingress proxy goes into
cilium_host; Instead, we configure BPF programs attached to the TC
egress filter of the endpoint device to ensure that it implements the
policy logic.

Treat this case as datapath mode "routed", where we will now skip those
rules. All other datapath configuration should be equivalent to direct
mode.

If we don't do this, then when applying L7 ingress policy, the traffic
from the ingress proxy towards the pod is first directed towards the
cilium_host device, then subsequently passed to the stack and re-routed
towards the endpoint device, which causes the BPF to lose the context
that this traffic comes from the proxy and hence the BPF program treats
it as newly inbound traffic from the world. As a result, inbound HTTP
requests see a message like:

```
$ kubectl exec tiefighter -- curl -s -XPOST 192.168.73.130/v1/request-landing                                                                                                                                                                  
upstream connect error or disconnect/reset before headers. reset reason: connection failure
```

This fixes the following policy cases:

• Ingress L7 policy in direct routing mode for traffic from the same node
• Ingress L7 policy in direct routing mode for traffic from a remote node

---

This change is 

[joestringer]

This currently causes some havoc with cilium-health IPv6 connectivity which I'm still figuring out. It's easy to reproduce with enable-ipv6: true and enable-endpoint-routes: true, and may be something to do with the new routed mode in bpf/init.sh.

[coveralls]

Coverage decreased (-0.02%) to 44.05% when pulling 9dc92b5 on joestringer:submit/fix-l7-ingress-rules into 125fe08 on cilium:master.

[joestringer]

test-me-please

EDIT: I think we're finally making progress. Now it's only connectivity to the remote node's cilium-health endpoint IP that is broken in direct-routing mode.

[joestringer]

test-me-please

[joestringer]

test-me-please

[joestringer]

test-me-please

[joestringer]

test-me-please

[joestringer]

test-me-please

EDIT: Successful k8s-1.10 run:
https://jenkins.cilium.io/job/Cilium-PR-Ginkgo-Tests-Validated/14623/flowGraphTable/

Other runs failed due to CI infrastructure issues.

[joestringer]

test-me-please

EDIT: Green CI run.

[ianvernon]

@joestringer needs a rebase to deal with bpf.sha conflict

[joestringer]

test-me-please