datapath: Do not SNAT if dst id is WORLD_ID
datapath: Do not SNAT if dst id is WORLD_ID

Unfortunately, we cannot SNAT a packet from a local endpoint only if
dst sec id is WORLD_ID. The problem with this is that in the case of
an FQDN policy, a world destination can get its own sec id, which makes
a packet destined to such target to bypass the check, and bypass the
SNAT.

To fix this, we SNAT a packet from a local endpoint if dst is neither
from native-routing-cidr nor REMOTE_HOST_ID.

Signed-off-by: Martynas Pumputis <6b0d31c0d563223024da45691584643ac78c96e8@lambda.lt>

michi-covalent/cilium,cilium/cilium,tklauser/cilium,cilium-team/cilium,michi-covalent/cilium,tklauser/cilium,tgraf/cilium,cilium-team/cilium,tklauser/cilium,tklauser/cilium,tgraf/cilium,cilium/cilium,cilium/cilium,michi-covalent/cilium,michi-covalent/cilium,cilium/cilium,tgraf/cilium,tgraf/cilium,michi-covalent/cilium,cilium/cilium,tgraf/cilium,tklauser/cilium,tgraf/cilium