This PR adds support for VRRP and IGMP protocols in host firewall.

Commit highlights

• Policy api/engine: The existing toPorts field is extended to support these protocols. As the protocols don't have transport ports, the existing validation check around empty ports is relaxed. Users can explicitly whitelist/deny these protocols using the toPorts rules, and these rules can be combined with the existing L3 rules.
• BPF datapath: Conntrack will now pass packets from these protocols that would previously be dropped with DROP_CT_UNKNOWN_PROTO error. This is gated behind a config flag so that it won't break existing allow-all policies. The decision to allow/deny such traffic is delegated to user-defined policies. Also, the existing behavior of allowing reply traffic based on conntrack state is preserved for VRRP and IGMP protocols as well.

Additional notes

• Policy api: Earlier version of this PR introduced a new field IPProtocols that would allow users to specify such IP protocols without transport ports using their IANA assigned numbers. This field was restricted to CCNP only using CEL rules. However, based on discussions with @jrajahalme and @squeed, we decided to reuse the existing toPorts field instead as the protocols don't need header fields matching similar to ICMP, and so the current use cases can be satisfied without introducing the new field. Note that the policy engine already supports policy matching with wildcard port field.
• Policy enforcement for hosts and pods: Support for VRRP and IGMP protocols has been extended to both host and pod traffic, leveraging the shared policy enforcement and conntrack logic common to bpf_host and bpf_lxc programs. This PR, however, focuses on host firewall in terms of testing. Filed issue for bpf_lxc tests - Add BPF tests for extended IP protocols support for pods #40229.

Results from manual testing:

$ cat lock-down-hw.yaml
apiVersion: "cilium.io/v2"
kind: CiliumClusterwideNetworkPolicy
metadata:
  name: "lock-down-ingress-worker-node"
spec:
  description: "Allow selected traffic on egress of worker nodes"
  nodeSelector:
    matchLabels:
      node-access: policy
  egress:
  - toPorts:
    - ports:
      - port: "22"
        protocol: TCP
      - port: "443"
        protocol: TCP
      - port: "6443"
        protocol: TCP
      - port: "2379"
        protocol: TCP
      - port: "4240"
        protocol: TCP
      - port: "8472"
        protocol: UDP
      - port: "0"
        protocol: VRRP

• Apply a host fw policy that allows L4 traffic on some ports but not VRRP. Traffic is denied with no match.
  Policy verdict log: flow 0x0 local EP ID 559, remote ID world, proto 112, egress, action deny, auth: disabled, match none, 172.19.0.4 -> 224.0.0.18
• Extend the toPorts rule to explicitly allow VRRP. Traffic is allowed.
• Explicitly deny VRRP traffic with toPorts rule. Traffic is denied with proto match.
  Policy verdict log: flow 0x0 local EP ID 559, remote ID world, proto 112, egress, action deny, auth: disabled, match Proto-Only, 172.19.0.4 -> 224.0.0.18
• Extend deny rules with to/forCIDR rules for VRRP. Traffic is denied via L3 match.
  Policy verdict log: flow 0x0 local EP ID 559, remote ID 16777217, proto 112, egress, action deny, auth: disabled, match L3-Only, 172.19.0.4 -> 224.0.0.18

Follow-up: E2E CI test and Hubble proto extensions

Fixes: #31502
Fixes: #18347

Add support for VRRP and IGMP protocols in host firewall