Prepare for release v1.14.9

[jrajahalme]

Summary of Changes

Minor Changes:

• bgpv1: BGP Control Plane metrics (Backport PR v1.14 Backports 2024-03-24 #31569, Upstream PR bgpv1: BGP Control Plane metrics #31469, @YutaroHayakawa)
• cni: use default logger with timestamps. (Backport PR v1.14 Backports 2024-03-12 #31335, Upstream PR cni: use default logger with timestamps. #31014, @tommyp1ckles)
• Introduce cilium-dbg encrypt flush --stale flag to remove XFRM states and policies with stale node IDs. (Backport PR v1.14 Backports 2024-03-12 #31335, Upstream PR cilium-dbg: New encrypt flush --stale flag #31159, @pchaigno)

Bugfixes:

• [v1.14 - Author backport] envoy: enable k8s secret watch even if only CEC is enabled ([v1.14 - Author backport] envoy: enable k8s secret watch even if only CEC is enabled #31452, @mhofstetter)
• Fix a bug where pod label updates are not reflected in endpoint labels in presence of filtered labels. (Backport PR v1.14 Backports 2024-03-15 #31474, Upstream PR Fix propagation of pod label change to endpoint labels in presence of filtered labels #31395, @tklauser)
• gateway-api: Retrieve LB service from same namespace (Backport PR v1.14 Backports 2024-03-19 #31495, Upstream PR gateway-api: Retrieve LB service from same namespace #31271, @sayboras)
• Handle InvalidParameterValue as well for PD fallback (Backport PR v1.14 Backports 2024-03-19 #31495, Upstream PR Handle InvalidParameterValue as well for PD fallback #31016, @hemanthmalla)
• helm: Update pod affinity for cilium-envoy (Backport PR v1.14 Backports 2024-03-19 #31495, Upstream PR helm: Update pod affinity for cilium-envoy #31150, @sayboras)
• Hubble: fix traffic direction and is reply when IPSec is enabled (Backport PR v1.14 Backports 2024-03-24 #31569, Upstream PR Hubble: fix traffic direction and is reply when IPSec is enabled #31211, @kaworu)
• k8s/utils: correctly filter out labels in StripPodSpecialLabels (Backport PR v1.14 Backports 2024-03-15 #31474, Upstream PR k8s/utils: correctly filter out labels in StripPodSpecialLabels #31421, @tklauser)

CI Changes:

• [v1.14] test: Remove duplicate Cilium deployments in some datapath config tests ([v1.14] test: Remove duplicate Cilium deployments in some datapath config tests #31521, @qmonnet)
• AKS: avoid overlapping pod and service CIDRs (Backport PR v1.14 Backports 2024-03-24 #31569, Upstream PR AKS: avoid overlapping pod and service CIDRs #31504, @bimmlerd)
• Centralize configuration of kind version/image in GitHub Action workflows (Backport PR v1.14 Backports 2024-03-06 #31192, Upstream PR Centralize configuration of kind version/image in GitHub Action workflows #30916, @giorio94)
• Checkout the target branch, instead of the default one, on pull_request based GHA test workflows (Backport PR v1.14 Backports 2024-03-06 #31192, Upstream PR gha: checkout target branch instead of the default one #31198, @giorio94)
• ci: Bump lvh-kind ssh-startup-wait-retries (Backport PR v1.14 Backports 2024-03-19 #31495, Upstream PR ci: Bump lvh-kind ssh-startup-wait-retries #31387, @YutaroHayakawa)
• ci: fix checking github.event.pull_request.head.sha (Backport PR v1.14 Backports 2024-03-19 #31495, Upstream PR ci: fix checking github.event.pull_request.head.sha #26775, @mhofstetter)
• controlplane: fix mechanism for ensuring watchers (Backport PR [v1.14] Author Backports for deflaking PRs #31542, Upstream PR controlplane: fix mechanism for ensuring watchers #31030, @bimmlerd)
• gha: checkout target branch in multi pool workflow (gha: checkout target branch in multi pool workflow #31545, @giorio94)
• gha: disable fail-fast on integration tests (Backport PR v1.14 Backports 2024-03-19 #31495, Upstream PR gha: disable fail-fast on integration tests #31420, @giorio94)
• gha: drop unused check_url environment variable (Backport PR v1.14 Backports 2024-03-06 #31192, Upstream PR gha: drop unused check_url environment variable #30928, @giorio94)
• introduce ARM github workflows (Backport PR v1.14 Backports 2024-03-12 #31335, Upstream PR introduce ARM github workflows #31196, @aanm)
• ipam: deepcopy interface resource correctly. (Backport PR v1.14 Backports 2024-03-19 #31495, Upstream PR ipam: deepcopy interface resource correctly. #26998, @tommyp1ckles)
• k8s_install.sh: specify the CNI version (Backport PR v1.14 Backports 2024-03-12 #31335, Upstream PR k8s_install.sh: specify the CNI version #31182, @aanm)
• loader: fix issue where errors cancelled compile cause error logs. (Backport PR v1.14 Backports 2024-03-12 #31335, Upstream PR loader: fix issue where errors cancelled compile cause error logs. #30988, @tommyp1ckles)
• Reduce flakiness of controlplane tests (Backport PR [v1.14] Author Backports for deflaking PRs #31542, Upstream PR Reduce flakiness of controlplane tests #30906, @bimmlerd)
• slices: don't modify missed input slice in test (Backport PR v1.14 Backports 2024-03-19 #31495, Upstream PR slices: don't modify missed input slice in test #31119, @bimmlerd)

Misc Changes:

• Add monitor aggregation for all events related to packets ingressing to the network-facing device. (Backport PR v1.14 Backports 2024-03-12 #31335, Upstream PR bpf: Enable monitor aggregation for all events in bpf_network.c #31015, @learnitall)
• Address race condition in TestGetIdentity (Backport PR [v1.14] Author Backports for deflaking PRs #31542, Upstream PR Address race condition in TestGetIdentity #30885, @bimmlerd)
• bgpv1: Adjust ConnectionRetryTimeSeconds to 1 in component tests (Backport PR v1.14 Backports 2024-03-12 #31335, Upstream PR bgpv1: Adjust ConnectionRetryTimeSeconds to 1 in component tests #31218, @YutaroHayakawa)
• chore(deps): update all github action dependencies (v1.14) (chore(deps): update all github action dependencies (v1.14) #31483, @renovate[bot])
• chore(deps): update all github action dependencies (v1.14) (chore(deps): update all github action dependencies (v1.14) #31583, @renovate[bot])
• chore(deps): update dependency cilium/cilium-cli to v0.16.3 (v1.14) (chore(deps): update dependency cilium/cilium-cli to v0.16.3 (v1.14) #31465, @renovate[bot])
• chore(deps): update docker.io/library/golang:1.21.8 docker digest to 8560736 (v1.14) (chore(deps): update docker.io/library/golang:1.21.8 docker digest to 8560736 (v1.14) #31481, @renovate[bot])
• chore(deps): update gcr.io/distroless/static-debian11:nonroot docker digest to 55c6361 (v1.14) (chore(deps): update gcr.io/distroless/static-debian11:nonroot docker digest to 55c6361 (v1.14) #31482, @renovate[bot])
• cilium-dbg: listing load-balancing configurations displays L7LB proxy port (Backport PR v1.14 Backports 2024-03-24 #31569, Upstream PR cilium-dbg: listing load-balancing configurations displays L7LB proxy port #31503, @mhofstetter)
• doc: Clarified GwAPI KPR prerequisites (Backport PR v1.14 Backports 2024-03-19 #31495, Upstream PR doc: Clarified GwAPI KPR prerequisites #31366, @PhilipSchmid)
• docs: Warn on key rotations during upgrades (Backport PR v1.14 Backports 2024-03-19 #31495, Upstream PR docs: Warn on key rotations during upgrades #31437, @pchaigno)
• Downgrade L2 Neighbor Discovery failure log to Debug (Backport PR v1.14 Backports 2024-03-12 #31335, Upstream PR Downgrade L2 Neighbor Discovery failure log to Debug #31179, @YutaroHayakawa)
• ingress: Update docs with network policy example (Backport PR v1.14 Backports 2024-03-12 #31335, Upstream PR ingress: Update docs with network policy example #31060, @sayboras)

Other Changes:

• bgpv1: Disable PodCIDR Reconciler for unsupported IPAM modes ([v1.14] bgpv1: Disable PodCIDR Reconciler for unsupported IPAM modes #31353, @YutaroHayakawa)
• install: Update image digests for v1.14.8 (install: Update image digests for v1.14.8 #31404, @thorn3r)
• v1.14: IPsec Fixes (v1.14: IPsec Fixes #31611, @pchaigno)

[maintainer-s-little-helper]

Commit 437dd84 does not match "Signed-off-by".

Please follow instructions provided in https://docs.cilium.io/en/stable/contributing/development/contributing_guide/#developer-s-certificate-of-origin