Better control plane tests for kube-apiserver entities

[squeed]

The special reserved:kube-apiserver label has an complex interaction. The source of this data is the Endpoints / EndpointSlice watcher. Additionally, the presence of this label on a prefix can result in at least 4 different cases, depending on which IP has the label:

1. The local node, in which case identity 1 gets the reserved:kube-apiserver label and the identity is mutated (fix).
2. A remote node, without --policy-cidr-match-mode=nodes, in which case that IP's identity changes from 6 (remote-node) to 7 (`kube-apiserver)
3. A remote node, with --policy-cidr-match-mode=nodes, in which case that IP gains an additional label and the identity is recalculated
4. An arbitrary IP, in which case that prefix gains a label and is upserted in to the ipcache.

When the IP in question is not a cluster node, it can be in several states:

• unknown to Cilium
• Already allocated via ToCIDR policy
• Already allocated via FQDN policy

We need to write controlplane tests, using the black-box control plane simulator in test/controlplane, that exercise as many of these state transitions as possible. We should also consider backporting these tests, as older versions also need to support all of these transitions.

[nathanjsweet]

Will these help?

[github-actions]

This issue has been automatically marked as stale because it has not
had recent activity. It will be closed if no further activity occurs.

[github-actions]

This issue has not seen any activity since it was marked stale.
Closing.