CKS lifecycle fails on VPC tier without an attached network ACL

##### ISSUE TYPE
* Bug Report

##### COMPONENT NAME
~~~
Kubernetes Service (CKS), VPC, Network ACL
~~~

##### CLOUDSTACK VERSION
~~~
4.22.1.0
main (reproduced by regression test at 4f117071c9397b1e4714c8fb61c384883c872842)
~~~

##### CONFIGURATION
Advanced zone with NSX-backed networking, VPC with an ACL-capable tier offering, and a CKS cluster deployed within a project.

The live reproduction used the NSX VPC offering `VPC offering with NSX - NAT Mode` and the tier offering `DefaultNSXVPCNetworkOfferingforKubernetesService`. The tier offering includes the NetworkACL service with provider Nsx.

##### OS / ENVIRONMENT
Management server on Debian 13, VMware vSphere hypervisor, NSX 4.2.4, NFS primary/secondary storage, and CKS Kubernetes v1.34.7.

##### SUMMARY
CKS create, etcd setup, validation, and delete paths throw an unboxing `NullPointerException` when a VPC tier does not yet have a network ACL attached.

A missing tier ACL is a supported CloudStack state, not an invalid database artifact:

- `createNetwork` declares `aclid` as optional.
- CloudStack deliberately stopped assigning default-deny unconditionally in CLOUDSTACK-2809 (`b5148af0c6dfc583bcd1a52a7510df80e9eaa163`).
- `NetworkACLServiceImpl.createAclListIfNeeded` explicitly preserves the legacy behavior of creating and attaching a custom ACL when a rule is created with `networkid` but no `aclid`.
- `NetworkACLItemDaoImpl.listByACL(null)` intentionally returns an empty list.

CKS already supplies `networkid` when provisioning a VPC-tier ACL rule, so it should reach that existing auto-create path. Instead, four comparisons auto-unbox the nullable `Long` returned by `Network.getNetworkACLId()` against primitive `long` constants:

- `KubernetesClusterManagerImpl.validateVpcTier`
- `KubernetesClusterResourceModifierActionWorker.createVpcTierAclRules`
- `KubernetesClusterResourceModifierActionWorker.removeVpcTierAclRules`
- `KubernetesClusterStartWorker.setupKubernetesEtcdNetworkRules`

This is present in 4.22.1.0, current `4.22`, and current `main`.

On an unmodified current-main checkout, focused regression tests covering these four nullable-ACL paths produced four errors with the same `Long.longValue()` NPE while all 56 existing/control tests passed.

##### STEPS TO REPRODUCE
~~~
1. Create a VPC with an offering compatible with the chosen ACL-capable tier offering.
2. Create the tier through the API without aclid:

cmk create network \
name=cks-null-acl-tier \
displaytext=cks-null-acl-tier \
networkofferingid= \
vpcid= \
zoneid= \
gateway=10.35.15.1 \
netmask=255.255.255.0

3. Confirm that listNetworks reports no aclid for the tier.
4. Create a CKS cluster on that tier.
5. After the create failure, stop and start the cluster, then attempt to delete it.
~~~

No database changes were used to create the failing state. The only omitted input was the optional `aclid`.

In the live 4.22.1.0 reproduction, all cluster VMs were provisioned before create failed in `createVpcTierAclRules`. The cluster remained in `Starting` with an empty endpoint. Stop succeeded, start then failed because the endpoint was never recorded, and delete failed in `removeVpcTierAclRules`.

Attaching an ACL with `replaceNetworkACLList` allowed cleanup to complete.

##### EXPECTED RESULTS
~~~
- A CKS cluster can use an ACL-capable VPC tier whose ACL has not yet been attached.
- CKS reaches the existing NetworkACLService behavior that creates and attaches a custom ACL when the first rule is added.
- Validation does not reject or NPE on a null ACL ID.
- Deleting a cluster from a tier that still has no ACL treats ACL cleanup as a no-op.
~~~

##### ACTUAL RESULTS
~~~
Create:

java.lang.NullPointerException: Cannot invoke "java.lang.Long.longValue()"
because the return value of "com.cloud.network.Network.getNetworkACLId()" is null
at com.cloud.kubernetes.cluster.actionworkers.KubernetesClusterResourceModifierActionWorker.createVpcTierAclRules(KubernetesClusterResourceModifierActionWorker.java:720)
at com.cloud.kubernetes.cluster.actionworkers.KubernetesClusterResourceModifierActionWorker.setupKubernetesClusterVpcTierRules(KubernetesClusterResourceModifierActionWorker.java:774)
at com.cloud.kubernetes.cluster.actionworkers.KubernetesClusterStartWorker.setupKubernetesClusterNetworkRules(KubernetesClusterStartWorker.java:624)
at com.cloud.kubernetes.cluster.actionworkers.KubernetesClusterStartWorker.startKubernetesClusterOnCreate(KubernetesClusterStartWorker.java:821)
at com.cloud.kubernetes.cluster.KubernetesClusterManagerImpl.startKubernetesCluster(KubernetesClusterManagerImpl.java:1865)

Delete:

java.lang.NullPointerException: Cannot invoke "java.lang.Long.longValue()"
because the return value of "com.cloud.network.Network.getNetworkACLId()" is null
at com.cloud.kubernetes.cluster.actionworkers.KubernetesClusterResourceModifierActionWorker.removeVpcTierAclRules(KubernetesClusterResourceModifierActionWorker.java:749)
at com.cloud.kubernetes.cluster.actionworkers.KubernetesClusterDestroyWorker.deleteKubernetesClusterVpcTierRules(KubernetesClusterDestroyWorker.java:197)
at com.cloud.kubernetes.cluster.actionworkers.KubernetesClusterDestroyWorker.deleteKubernetesClusterNetworkRules(KubernetesClusterDestroyWorker.java:215)
at com.cloud.kubernetes.cluster.actionworkers.KubernetesClusterDestroyWorker.destroy(KubernetesClusterDestroyWorker.java:326)
at com.cloud.kubernetes.cluster.KubernetesClusterManagerImpl.destroyKubernetesCluster(KubernetesClusterManagerImpl.java:2439)
~~~

Commencez par les comparaisons d’ACL nullable dans KubernetesClusterManagerImpl.validateVpcTier et KubernetesClusterResourceModifierActionWorker.createVpcTierAclRules/removeVpcTierAclRules, puis examinez KubernetesClusterStartWorker.setupKubernetesEtcdNetworkRules. Exécutez les tests de régression ciblés couvrant ces quatre chemins. C’est terminé lorsqu’un VPC tier sans ACL associée ne provoque plus de NPEs lors de la validation, de la création, du démarrage ou de la suppression, et que le comportement existant de création et de nettoyage automatiques des ACL reste intact.

Rédigé par le modèle d'indexation à partir du texte de l'issue.