Share kernel Wireguard port with raw socket (#826)

This PR brings support of a shared port between stun (ICE agent) and
the kernel WireGuard

It implements a single port mode for execution with kernel WireGuard
interface using a raw socket listener.

BPF filters ensure that only STUN packets hit the NetBird userspace app

Removed a lot of the proxy logic and direct mode exchange.

Now we are doing an extra hole punch to the remote WireGuard 
port for best-effort cases and support to old client's direct mode.

sharedsock/filter_nolinux.go

@@ -0,0 +1,8 @@
+//go:build !linux
+
+package sharedsock
+
+// NewSTUNFilter is a noop method just because we do not support BPF filters on other platforms than Linux
+func NewSTUNFilter() BPFFilter {
+	return nil
+}