iptables: Fix incorrect SNAT for externalTrafficPolicy=local
iptables: Fix incorrect SNAT for externalTrafficPolicy=local

So far, Cilium has installed a rule to clear the masquerade bit set by
kube-proxy in an attempt to still expose the correct source IP for kube-proxy
traffic regardless of the externalTrafficPolicy setting.

This works relatively well unless hostPort is getting involved. By clear the
bit, it is no longer possible to distinguish hostPort traffic and traffic for
which externalTrafficPolicy=local has been set.

Revert this strategy and stop clearing the masquerade bit. This allows to
remove several SNAT/MASQUERADE rules installed by Cilium which attempted to
replicate the kube-proxy SNAT behavior. Instead, leave it up to the user to
properly set externalTrafficPolicy=local.

Signed-off-by: Thomas Graf <5f50a84c1fa3bcff146405017f36aec1a10a9e38@cilium.io>

tgraf/cilium,michi-covalent/cilium,tklauser/cilium,cilium/cilium,cilium-team/cilium,michi-covalent/cilium,tgraf/cilium,tgraf/cilium,tgraf/cilium,cilium-team/cilium,tgraf/cilium,michi-covalent/cilium,cilium/cilium,michi-covalent/cilium,tgraf/cilium,michi-covalent/cilium,tklauser/cilium,cilium/cilium,tklauser/cilium,cilium/cilium,cilium/cilium,tklauser/cilium,tklauser/cilium