Fix antrea-io#5681

Network policy didn't work when using a server Pod to establish a
connection to the service provided by itself. This hairpin service
connection initiated through a local Pod will be SNATed to the
gateway IP, which will prevent it from being correctly categorized by
the network policy during the Ingress rule enforcement.

This commit added a bypass flow to always allow the hairpin service
connection to address this issue. Given we don't consider self-access
blocking to be a valid case.

Signed-off-by: graysonwu <wgrayson@vmware.com>

1. Skip allowHairpinSerivce test when Antrea-Proxy is disabled.
2. Add documentation including the behavior of the hairpin service
   when Antrea-Proxy is enabled and disabled.

Signed-off-by: graysonwu <wgrayson@vmware.com>