ipsec: Generate from-stack trace for ipsec packets
ipsec: Generate from-stack trace for ipsec packets

When ipsec packets comes from the host (xfrm) stack to from-host program
(bpf_host), it bypasses the send_trace_notify (<- stack). As a result, we
only see the trace for inner packet (ICMPRequest/Reply with <- endpoint
and -> stack). Fix bpf_host program not to bypass the trace.

Note that since we moved do_netdev_encrypt after
inherit_identity_from_host, we cannot extract identity from ctx->mark
anymore, because inherit_identity_from_host wipes the mark. That's why
we need to pass inherited identity to do_netdev_encrypt. Otherwise, in
tunneling mode, get_identity doesn't work correctly.

Trace on source node before fix

```
<- endpoint ... EchoRequest
-> stack ... EchoRequest
```

Trace on the source node after fix

```
<- endpoint ... EchoRequest
-> stack ... EchoRequest
<- stack encrypted ...
```

Signed-off-by: Yutaro Hayakawa <65647db0e0f9a5caf65d28f8fe7f0278d9794968@isovalent.com>

cilium/cilium,michi-covalent/cilium,michi-covalent/cilium,michi-covalent/cilium,cilium/cilium,cilium/cilium,michi-covalent/cilium,cilium/cilium,cilium/cilium,michi-covalent/cilium