kernel-wfp: Fix logging of MM/QM/EM NetEvent failures
kernel-wfp: Define IPsec related ALE layers and callout GUIDs
kernel-wfp: Add missing IPsec sublayer GUIDs
kernel-wfp: Install inbound ALE IP-in-IP filters

When processing inbound tunnel mode packets, Windows decrypts packets and
filters them as IP-in-IP packets. We therefore require an ALE filter that
calls the FWPM_CALLOUT_IPSEC_INBOUND_TUNNEL_ALE_ACCEPT callout to allow them
when using a default-drop policy.

Without these rules, any outbound packet created an ALE state that allows
inbound packets as well. Processing inbound packets without any outbound
traffic fails without these rules.
kernel-wfp: Install outbound ALE connect rules for IPsec

Similar to the inbound rules, the ALE filter processes IP-in-IP packets for
outbound tunnel mode traffic. When using an outbound default-drop policy,
Windows does not allow connection initiation without these explicit rules.
Merge branch 'wfp-drop-firewall'

Introduces ALE layer WFP rules to accept tunnel mode packets in Windows
stateful packet filtering if default-drop policies are used.