Security improvement: support host firewall in Cilium

**What would you like to be added**:
We would like to be able to use cilium's [host firewall feature](https://docs.cilium.io/en/stable/security/host-firewall/#id1).

**Why is this needed**:
Kubernetes native network policies cannot be used to protect the host network (nor pods with hostnetwork=true). So, with the current CNI implementation (bundled Cilium without CRDs) we cannot protect the EKS-A cluster nodes and services on them from external (non-kubernetes) traffic. Cilium [host policies](https://docs.cilium.io/en/stable/security/policy/language/#hostpolicies) (cluster wide network policies with node selectors) would allow us to protect the whole cluster in a Kubernetes way.

EKS Anywhere Bare Metal took the approach to fully manage the life-cycle of the nodes starting from the provisioning (personally, I love this!). This means that users are not really handling the configuration of the nodes, they more like a black box for us. We can do some customization throughout the installation or through building custom images for the nodes but in general, this solution makes it unnecessary to use configuration management systems (puppet, ansible etc.) for the nodes. As such, we believe that EKS-A should provide us tools to be able to restrict traffic to/from the outside world to services (like Kubelet, API server etc.) on the node as well.

Start by reading the linked Cilium host firewall and host policies documentation, then inspect EKS-A's current CNI integration, especially its bundled-Cilium-without-CRDs limitation. Done means providing a supported way to apply host policies that protect EKS-A nodes and services from external traffic.

Written by the indexing model from the issue text.