datapath: Set WORLD_ID in fwd-ed NodePort BPF requests
datapath: Set WORLD_ID in fwd-ed NodePort BPF requests

Previously, when running in the tunneling mode, the NodePort BPF used
SECLABEL (=HOST_ID) in the encapsulated request's header which was
forwarded to a node running a selected service endpoint. This made the
node to believe, that the request originated from the in-cluster node.
The side-effect of this was that any netpol which denied access from
outside to the service endpoint could been bypassed.

Fix this by propagating the WORLD_ID instead of the HOST_ID in the
encapsulated request.

Reported-by: Rahul Sharma
Signed-off-by: Martynas Pumputis <6b0d31c0d563223024da45691584643ac78c96e8@lambda.lt>

michi-covalent/cilium,cilium/cilium,michi-covalent/cilium,cilium/cilium,michi-covalent/cilium,cilium/cilium,cilium/cilium,cilium/cilium,michi-covalent/cilium,michi-covalent/cilium