Description of problem:
ACLs applied on egress pipeline (direction=to-lport) that match on source ip don't work for hairpinned traffic, because hairpinning SNATs to service ip.
If we know that hairpinning was applied, we know that ip.src == ip.dst, and can use the following expression to include hairpinned traffic:
ip.src == ip || pkt.hairpinned && ip.dst == ip

To do so, we need a new flag pkt.hairpinned (this name is not a requirement, but just a placeholder) that will signal if hairpinning happened on ingress pipeline.

This will be used for network policy implementation in ovn-k to make sure hairpinned traffic is affected by network policy rules.