add support for NDLB-force-rport=safe param that does force-rport behavior only on endpoints we know are safe to do so on.  This is a dirty hack to try to work with certain endpoints behind sonicwall which does not use the same port when it does nat, when the devices do not support rport, while not breaking devices that acutally use different ports that force-rport will break