Add traffic drop sub reasons and do validation for those

[aanm]

Right now, when doing flow validation, the result only checks if the traffic is dropped:

cilium-cli/connectivity/check/policy.go

Lines 197 to 198 in 1735870

	// Request is dropped
	Drop bool

. It is not checking why and where exactly the traffic was dropped.

However, traffic can be dropped for multiple reasons such as routing problems, iptables, etc. Thus, we should have sub reasons for why a traffic is dropped so that we can be sure that the end result of a test is actually the one that we should be expecting to see.

Some examples are:

• Traffic dropped by a deny policy
• Traffic dropped at ingress of a pod
• Traffic dropped at egress of a pod

[aanm]

@pchaigno do you have other examples?

[pchaigno]

Apart from checking the drop reason and direction, it could be good to check the remote security identity. For that last one, it's probably enough to check that it is neither unknown nor a reserved identity unless expected. Checking the exact pod identity is probably overengineering/overtesting.

Checking the identity may help us catch cases where we dropped the packets because the identity resolution failed and it should have succeeded but failed to find a corresponding policy rule afterward. Definitely less important than checking the drop reason and direction.

[sayboras]

Apart from checking the drop reason and direction, it could be good to check the remote security identity. For that last one, it's probably enough to check that it is neither unknown nor a reserved identity unless expected.

I missed this point in related PR, raised #1100 for tracking purpose.