[ upstream commit e6ad7438357da93e5c5dbf823e71ae349adde61d ]

[ Backporter's notes: Conflicts were mostly to convert the methods on
               (ipc *IPIdentityCache) to the global IPIdentityCache. ]

Previously, the logic would only upsert identities into the IPCache if
the identity was newly allocated. Logically this makes sense, as the
relationship between a CIDR identity and the ipcache should be tightly
coupled. However, we have observed in some user environments that
ipcache entries may end up being removed from the datapath and the
corresponding identity would remain allocated in userspace. As a result,
the next time a DNS request arrives which intends to make use of that
identity for subsequent connection attempts, it would not populate the
ipcache with the identity, leading to packet loss on the connection
allowed by ToFQDNs policy.

In order to mitigate this issue, ensure that all identities used in DNS
responses are populated into the datapath, and track a metric for any
cases where this occurs for identities that we expect to already be
present in the IPCache. This way, active issues should be mitigated,
but we also still have a way to detect whether this mitigation is
necessary and whether we need to further investigate the root cause of
this issue.

Signed-off-by: Joe Stringer <joe@cilium.io>