kern: wg: remove overly-restrictive address family check

IPv4 packets can be routed via an IPv6 nexthop, so the handling of the
parsed address family is more strict than it needs to be. If we have a
valid header that matches a known peer, then we have no reason to
decline the packet.

Convert it to an assertion that it matches the destination as viewed by
the stack below it, instead. dst may be the gateway instead of the
destination in the case of a nexthop, so the af assignment must be
switched to use the destination in all cases.

Add a test case that approximates a setup like in the PR and
demonstrates the issue.

PR: 284857
Reviewed by: markj (earlier version), zlei

(cherry picked from commit 2bef0d54f74dad6962ef7d1dfa407e95cb4fb4ad)