fix: add iptables rules for dns in vnet scale cilium case

[QxBytes]

Reason for Change:

In the vnet scale scenario, we use the node's ip as the primary ip instead of an ip from the pod's subnet (what happens in pod subnet mode). In cilium, we add snat rules from the cns, and base our snat on the primary ip + subnet. However, the primary ip is now the node ip, meaning we only snat packets from the node's primary ip w/ the pod subnet cidr. It should be that we also snat packets from the pod subnet's network/cidr. This change modifies the cns to grab any secondary ip from the pod subnet, combine it with the pod subnet cidr, and create an iptable rule for the pod subnet. The cidr is for the whole subnet space (applies to all static ip blocks allocated).

Issue Fixed:

See above

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• relevant PR labels added

Notes:
Manually tested cilium w/ updated cns and iptable rule(s) are created with pod subnet cidr. DNS traffic succeeds afterwards.

[nairashu]

Let's replace existing SNAT rules and verify IMDS works if not we might have to update the IMDS rule as well for Vnet Scale in Cillium. Source should be coming from the secondary IPs to use the podsubnet and destination should be ncPrimaryIP for SNAT. For IMDS same source but destination is always HostPrimaryIP

[QxBytes]

/azp run Azure Container Networking PR

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).

[QxBytes]

/azp run Azure Container Networking PR

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).