cilium: default to snat instead of hybrid for kube-proxy-free mode
cilium: default to snat instead of hybrid for kube-proxy-free mode

Use SNAT mode by default. It turns out that Hybrid or full DSR is not
compatible given the custom IP options it uses underneath. We've seen
that packets from the node where the NodePort request first arrives to
the remote backends where we add the service tuple are silently dropped
on some of the public cloud providers. Until we can be sure that there
are no known issues in such environments we should rather switch to
SNAT in order to not have users run into such issues that are rather
cumbersome to debug.

Signed-off-by: Daniel Borkmann <3d0f3b9ddcacec30c4008c5e030e6c13a478cb4f@iogearbox.net>

cilium/cilium,michi-covalent/cilium,tgraf/cilium,tklauser/cilium,cilium-team/cilium,michi-covalent/cilium,cilium/cilium,cilium/cilium,tklauser/cilium,tgraf/cilium,tgraf/cilium,michi-covalent/cilium,cilium/cilium,tklauser/cilium,tklauser/cilium,michi-covalent/cilium,tgraf/cilium,tgraf/cilium,cilium-team/cilium,tgraf/cilium,michi-covalent/cilium,tklauser/cilium,cilium/cilium