[Feature] Expose Cilium --policy-deny-response (ICMP on policy denials) for Azure CNI Powered by Cilium

**Is your feature request related to a problem? Please describe.**
On AKS clusters using Azure CNI Powered by Cilium, network policy denials (L3/L4) currently result in a silent DROP. Client applications therefore experience long connection timeouts (often 20–30+ seconds depending on TCP SYN retries) instead of an immediate failure when traffic is blocked by policy.

This makes debugging harder and degrades application experience (hangs instead of fast “connection refused / no route to host” style errors).

Upstream Cilium (since ~1.19, PR https://github.com/cilium/cilium/pull/41406) added the agent flag `--policy-deny-response=icmp`. When set, denied IPv4 egress packets receive an ICMP Destination Unreachable (Packet Filtered) reply so clients fail fast. Further improvements (IPv6, ingress, TCP RST, per-policy control) are tracked in https://github.com/cilium/cilium/issues/41859.

Today this flag cannot be enabled on managed Azure CNI Powered by Cilium because AKS does not expose most Cilium agent configuration (only limited ConfigMap changes such as label exclusions are supported). Customers who need the behavior must switch to BYOCNI + self-managed Cilium.

**Describe the solution you'd like**
Expose the Cilium `--policy-deny-response` setting (or an equivalent high-level option) for managed Azure CNI Powered by Cilium clusters, ideally:

- As a cluster-level setting (Azure CLI / ARM / Terraform / Bicep) or via Advanced Container Networking Services (ACNS).
- Default remains the current silent-drop behavior for backward compatibility.
- Document any requirements (e.g., allowing ICMP ingress so the reply can reach the source pod).

Once enabled, it should apply cluster-wide to supported policy-denied egress traffic (as the upstream flag does).

**Describe alternatives you've considered**
- Switch the cluster to BYOCNI and self-manage Cilium (works, but loses the managed experience and Azure support model for the CNI).
- Rely on L7 policies (via ACNS) where possible, since they can return application-level errors, but this does not cover pure L3/L4 denials.
- Application-level timeouts / circuit breakers (does not solve the root cause of silent drops and still incurs unnecessary delay).

**Additional context**
- Upstream feature: Cilium PR #41406 and docs under “Policy Deny Response Handling”.
- Follow-up work: https://github.com/cilium/cilium/issues/41859.
- Current AKS limitation: managed Cilium ConfigMap changes beyond label exclusion are not supported (see AKS docs on Azure CNI Powered by Cilium).
- This would improve UX and observability for network-policy-heavy workloads without requiring customers to leave the managed dataplane.