[ upstream commit 9cc8a89f914195d52a8b3df021215b4051348b45 ]

Our logic to clean up old XFRM configs on node deletion currently relies
on the destination IP to identify the configs to remove. That doesn't
work with ENI and Azure IPAMs, but until recently, it didn't need to. On
ENI and Azure IPAMs we didn't have per-node XFRM configs.

That changed in commit 3e59b681f ("ipsec: Per-node XFRM states &
policies for EKS & AKS"). We now need to clean up per-node XFRM configs
for ENI and Azure IPAM modes as well, and we can't rely on the
destination IP for that because the XFRM policies don't match on that
destination IP.

Instead, since commit 73c36d45e0 ("ipsec: Match OUT XFRM states &
policies using node IDs"), we match the per-node XFRM configs using node
IDs encoded in the packet mark. The good news is that this is true for
all IPAM modes (whether Azure, ENI, cluster-pool, or something else).

So our cleanup logic can now rely on the node ID of the deleted node to
clean up its XFRM states and policies. This commit implements that.

Fixes: 3e59b681f ("ipsec: Per-node XFRM states & policies for EKS & AKS")
Signed-off-by: Paul Chaignon <paul.chaignon@gmail.com>