Automatic merge from submit-queue

kube-proxy: filter INPUT as well as OUTPUT

We need to apply filter rules on the way in (nodeports) and out (cluster
IPs).  Testing here is insufficient to have caught this - will come back
for that.

Fixes #43969

@justinsb since you have the best repro, can you test?  It passes what I think is repro.

@ethernetdan we will want this in 1.6.x

```release-note
Fix bug with service nodeports that have no backends not being rejected, when they should be.  This is not a regression vs v1.5 - it's a fix that didn't quite fix hard enough.
```