cloud/azure: make icmp_allow_all rule ICMP-only

[embik]

What this PR does / why we need it:
Historically, KKP created an Azure NSG that had a workaround/hack in place to only allow IMCP traffic:

// Alright, so here's the deal. We need to allow ICMP, but on Azure it is not possible
// to specify ICMP as a protocol in a rule - only TCP or UDP.
// Therefore we're hacking around it by first blocking all incoming TCP and UDP
// and if these don't match, we have an "allow all" rule. Dirty, but the only way.
// See also: https://tinyurl.com/azure-allow-icmp

This has been in the code forever, the link goes to a 2015 page, and in the mean time Azure has introduced ICMP as protocol for NSG rules. So this PR does the following things:

• Changes the icmp_allow_all rule to actually only allow IMCP as protocol
• Move the icmp_allow_all rule before the TCP and UDP deny-all rules in priority

Because Azure is implemented as reconciling provider, this change will be applied to existing clusters as well.

Which issue(s) this PR fixes:

Fixes #

What type of PR is this?
/kind cleanup

Special notes for your reviewer:

Does this PR introduce a user-facing change? Then add your Release Note here:

The `icmp_allow_all` rule of the Azure NSG created for each cluster now only allows ICMP and takes precedence over the TCP and UDP catch-all rules that were guarding it

Documentation:

NONE

[embik]

/test pre-kubermatic-e2e-azure-ubuntu-1.27

[kron4eg]

/approve
/lgtm

[kubermatic-bot]

LGTM label has been added.

Git tree hash: ad1514db5baef5057b95e6829d9cc07afe4c3e14

[kubermatic-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: embik, kron4eg

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• pkg/provider/cloud/OWNERS [embik,kron4eg]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment