Fix BPF filter for VLAN tagged packets

 - Linux kernel no longer puts (outermost) vlan tags within the packet
   but in packet metadata.
   Use special ANC negative offsets when generating the filter code to
   check if it's a vlan tagged packet and whether the vlan ID matches
   that of the one specified in the filter expression.
 - When executing the filter code in userland, take care of these special
   ANC values - use the vlan tag extracted from the packet metadata for
   comparison.
 - For saving the captured packets, re-insert the vlan tags back into the
   packet. That way, both old and new pcap files will have vlan tags
   inserted into the packet itself in the pcap files. The behaviour would
   not change between old and new kernels.
 - For older Linux kernels that had the vlan tags as a part of the packet
   and those kernels that did not have the special ANC opcodes for vlan tag
   access, use the old mechanism - generate filter code that looks into the
   packet offset for vlan tags. To differentiate between old and new kernels,
   we try to load a filter with a bogus ANC offset. If that fails, then the
   kernel has the ANC offset validation patch. Then we try another filter
   with one of the new ANC offsets for inspecting VLAN tag and if that works
   we know that we can safely use the new filter code.
 - For all platforms other than Linux, do not change the current behaviour.
 - When 'vlan' keyword is not specified in the filter expression, the filter
   code generator by default adds a 'not vlan' expresion so that
   only untagged packets pass the filter. For example, 'tcp port 80' will
   generate 'tcp port 80 and not vlan' This is necessary because since the
   vlan tags are not inline in the packet at a particular offset, a simple
   comparison of ether-id with 0x8100 will not work.

Signed-off-by: Ani Sinha <ani@aristanetworks.com>