endpoint: Guarantee to reject endpoint creation with reserved labels
endpoint: Guarantee to reject endpoint creation with reserved labels

Perform the check for reserved labels before filtering the subset of identity
relevant labels to guarantee rejecting all requests trying to bind to reserved
labels.

Signed-off-by: Thomas Graf <5f50a84c1fa3bcff146405017f36aec1a10a9e38@cilium.io>

tgraf/cilium,michi-covalent/cilium,tklauser/cilium,cilium/cilium,cilium/cilium,cilium-team/cilium,cilium/cilium,tklauser/cilium,tgraf/cilium,tklauser/cilium,tklauser/cilium,cilium/cilium,tklauser/cilium,michi-covalent/cilium,michi-covalent/cilium,michi-covalent/cilium,cilium-team/cilium,tgraf/cilium,cilium/cilium,tgraf/cilium,tgraf/cilium,michi-covalent/cilium,tgraf/cilium