bpf: Move to-stack trace after host firewall
bpf: Move to-stack trace after host firewall

When host firewall feature is enable, to-stack trace can be generated
even if the packets are rejected by host firewall policies. Generate trace
only when the packets are actually delivered to the stack.

Fixes: #12562
Signed-off-by: Yutaro Hayakawa <65647db0e0f9a5caf65d28f8fe7f0278d9794968@isovalent.com>

cilium/cilium,cilium/cilium,cilium/cilium,cilium/cilium,michi-covalent/cilium,michi-covalent/cilium,michi-covalent/cilium,michi-covalent/cilium,michi-covalent/cilium,cilium/cilium