Checker can not evaluate named ports

Expected Behavior

When an endpoint is defined with a named port, checker should be able to translate the name to actual ports.

Current Behavior

In the app-policy checker, a rule that references a named port never matches, so an Allow rule denies by default (and a Deny rule silently does nothing).

Possible Solution

Extend policy store to get translate the name port via CalcGraph.

Steps to Reproduce (for bugs)

1. Define a workload endpoint with a named port, e.g. a port named http 8080.
2. Apply a policy that references it by name:

   apiVersion: projectcalico.org/v3
   kind: GlobalNetworkPolicy
   metadata:
     name: allow-http-named-port
   spec:
     selector: app == 'server'
     types: [Ingress]
     ingress:
       - action: Allow
         protocol: TCP
         destination:
           ports: [http]
   

3. Enable Application Layer Policy so the flow is evaluated by the app-policy checker (Dikastes), and send TCP to the endpoint on 8080.
4. Observe the request is denied. The dataplane (non-ALP) allows the same flow.

Unit-level repro (no cluster): populate an IPSetUpdate_IP_AND_PORT set with "10.0.0.1,tcp:8080", reference it via a rule's DstNamedPortIpSetIds, and call matchDstPort for a flow to 10.0.0.1:8080/tcp — it returns false.

Context

Found this while working on my policy evaluator project Telepathy.

Your Environment

• Calico version: observed against master (app-policy/checker/match.go, app-policy/policystore/ipset.go); the code path predates and is unchanged on recent releases.
• Calico dataplane (bpf, nftables, iptables, windows etc.): Application Layer Policy (Dikastes/Envoy) evaluation path; main dataplanes unaffected.
• Orchestrator version (e.g. kubernetes, openshift, etc.): any
• Operating System and version: any
• Link to your project (optional):