Make sure we can deal with ICMP DUs and TEs

Make sure we can deal with ICMP Destination Unreachable and Time Exceeded coming back to the guest. We need to make sure this works both for 1:1 NAT and SNAT.

This could be tricky because the ICMP DU/TE could come back for all types of traffic, not just ICMP Echo/Reply. For example, I believe a TCP SYN to an unreachable destination would result in a DU and we need to make sure that can make it through the inbound path (unless the firewall is explicitly configured to drop inbound ICMP). This could actually be tricky to do because we might want to make sure the DU is in response to a valid flow, which means we might want the Rule to be able to predicate against the TCP flows table or predicate against the UFT. Furthermore, we need to rewrite the ICMP DU body so that its IP matches that of the expected VPC (private) IP, otherwise the guest will see its external IP and have no idea what this DU is in relation to. This also means that for SNAT we need to remap the port as well.

Start by tracing the inbound ICMP path and the existing 1:1 NAT and SNAT handling; inspect how TCP flows and the UFT could validate related traffic. Done means ICMP Destination Unreachable and Time Exceeded messages for relevant traffic reach the guest, with embedded IP and port information rewritten correctly and firewall drops respected.