Per-node configuration overrides (v2)

[squeed]

This un-reverts #22163, which was reverted in #22630. The only difference

• Tolerate the CRD not existing, which can happen in cleanup mode
• Fixup the l4lb test, pulling in the change test/l4lb, nat64x46: pass k8s api server to the standalone proxy #22627

The message from 22163 is included below.

---

This adds the ability to tweak configuration on a per-node basis, as designed in #22036. Specifically, there is an InitContainer that implements the configuration resolution logic. It writes a directory that imitates ConfigMaps, so there are no code changes in the agent itself.

This adds a new type, ClilumNodeConfig, that allows for tweaking configuration flags on a fine-grained basis. For example, you could create

apiVersion: cilium.io/v2alpha1
kind: CiliumNodeConfig
metadata:
  namespace: kube-system
  name: kube-proxy-replacement
spec:
  nodeSelector: 
    matchLabels:
      io.cilium.kube-proxy-replacement: "" 
  defaults:
    kube-proxy-replacement: strict

then add a NodeAntiAffinity to the kube-proxy daemonset. Then, one by one, label nodes with io.cilium.kube-proxy-replacement: "". This will cause that node to begin using this particular configuration override.

Fixes: #22036

Add per-node configuration overrides. There is a new Kubernetes resource type, CiliumNodeConfig, which allows for fine-grained configuration of Nodes based on label selectors.

(Note: This also includes a CI workaround for the extra roles; I'll fix that in cilium-cli and remove it shortly).

[squeed]

/test

[squeed]

This needs cilium/cilium-cli#1286 to merge for CI to be green (I'm not sure why the previous PR worked).