[kube-proxy] Fix session affinity with local endpoints traffic

[MrHohn]

What this PR does / why we need it:
Set up session affinity rules in svcXlbChain over local endpoints. It is basically a mirror of what we set in svcChain:

kubernetes/pkg/proxy/iptables/proxier.go

Lines 1423 to 1433 in 012b085

	// First write session affinity rules, if applicable.
	if svcInfo.sessionAffinityType == api.ServiceAffinityClientIP {
	for _, endpointChain := range endpointChains {
	writeLine(proxier.natRules,
	"-A", string(svcChain),
	"-m", "comment", "--comment", svcNameString,
	"-m", "recent", "--name", string(endpointChain),
	"--rcheck", "--seconds", strconv.Itoa(svcInfo.stickyMaxAgeSeconds), "--reap",
	"-j", string(endpointChain))
	}
	}

Which issue(s) this PR fixes (optional, in fixes #<issue number>(, fixes #<issue_number>, ...) format, will close the issue(s) when PR gets merged):
Fixes #55429

Special notes for your reviewer:
@nicksardo @bowei

Release note:

Fix session affinity issue with external load balancer traffic when ExternalTrafficPolicy=Local.

[thockin]

/lgtm
/approve

[k8s-github-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: MrHohn, thockin

Associated issue: 55429

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these OWNERS Files:

• pkg/proxy/OWNERS [thockin]
• pkg/util/iptables/OWNERS [thockin]

You can indicate your approval by writing /approve in a comment
You can cancel your approval by writing /approve cancel in a comment

[k8s-github-robot]

Automatic merge from submit-queue (batch tested with PRs 55561, 55519). If you want to cherry-pick this change to another branch, please follow the instructions here.

[nicksardo]

@MrHohn Is the issue only when using an external LB? Isn't traffic via clusterIP and nodeport also vulnerable?

Is this worth cherrypicking?

[MrHohn]

@nicksardo In fact, check again and I think this will affect external traffic for nodePort as well. In cluster traffic (captured by CIDR 10/X) to clusterIP, nodePort and loadBalancer will not be affected.

Will attempt to cherrypick this to 1.8 and 1.7.

[MrHohn]

cc @bowei Did a quick scan and haven't found other incompatible service feature with ESIPP.