arpa: do not send all ARP replies to the controller

ARP replies should only be sent to the controller if the source check failed.