ipsec: ensure all trace events are discarded when mon. agg. is enabled

[learnitall]

This commit modifies calls to send_trace_notify in the datapath to drop trace events related to encrypted packets when monitor aggregation is enabled. More specifically, this commit ensures that whenever send_trace_notify is called with a trace_reason of TRACE_REASON_ENCRYPTED, the monitor argument is set to zero. A Coccinelle script is provided in this commit to add a build-time check for this requirement moving forward.

This change helps to reduce the overall CPU usage of Cilium Agents when IPSec encryption is enabled, by reducing the number of trace events emitted by the datapath. Normally monitor aggregation can be used in order to reduce the number of trace events, however IPSec-related trace events are not able to be aggregated since they lack the necessary connection tracking information. See the function emit_trace_notify in bpf/lib/trace.h for more information.

This endeavor was first started in cilium/cilium#27168, however, in said PR I missed a couple of spots where this type of change could also be applied. This PR acts as a follow-up to ensure that all places where TRACE_REASON_ENCRYPTED appears in a call to send_trace_notify, the argument monitor is set to zero.

Please ensure your pull request adheres to the following guidelines:

• For first time contributors, read Submitting a pull request
• All code is covered by unit and/or runtime tests where feasible.
• All commits contain a well written commit description including a title,
  description and a Fixes: #XXX line if the commit addresses a particular
  GitHub issue.
• If your commit description contains a Fixes: <commit-id> tag, then
  please add the commit author[s] as reviewer[s] to this issue.
• All commits are signed off. See the section Developer’s Certificate of Origin
• Provide a title or release-note blurb suitable for the release notes.
• Are you a user of Cilium? Please add yourself to the Users doc
• Thanks for contributing!

Fix and prevent future bugs limiting pod-to-pod network performance under high load when tunneling and IPSec are both enabled.

[pchaigno]

Nice fix, perfect commit description, and impressive work on Coccinelle! 🚀

[julianwiedmann]

/test

[learnitall]

/test

[learnitall]

Hit two flakes:

• Conformance Runtime: CI: Runtime Test (privileged) - Test_NeighborGracefulRestart - did not receive expected peering state ["ESTABLISHED"] #28415
• Conformance E2E: CI: Conformance E2E: client-egress-l7/pod-to-world/http-to-one.one.one.one-0: The requested URL returned error: 503 #29895

[learnitall]

/test

[pchaigno]

@learnitall You'll need to rebase to catch https://github.com/cilium/cilium/pull/29958/commits and pass the CI.

[ldelossa]

LGTM