bpf: Enforce host policies before BPF-based SNAT
bpf: Enforce host policies before BPF-based SNAT

This fix is required to get the host policies to work properly with
BPF-backed NodePort services. It is not a sufficient fix, but required
to resolve the 4.19 program size issue in subsequent commits, so sending
now.

Fixes: 88bf291 ("bpf: Enforce host policies for IPv4")
Signed-off-by: Paul Chaignon <a027184a55211cd23e3f3094f1fdc728df5e0500@cilium.io>

michi-covalent/cilium,tklauser/cilium,tklauser/cilium,michi-covalent/cilium,michi-covalent/cilium,cilium-team/cilium,tgraf/cilium,cilium/cilium,cilium-team/cilium,cilium/cilium,tgraf/cilium,tklauser/cilium,tklauser/cilium,tgraf/cilium,tgraf/cilium,tgraf/cilium,michi-covalent/cilium,tklauser/cilium,michi-covalent/cilium,cilium/cilium,cilium/cilium,cilium/cilium,tgraf/cilium