NLB creation fails when ipFamilyPolicy is PreferDualStack but cluster only supports IPv4

Description

When creating a Network Load Balancer with ipFamilyPolicy: PreferDualStack on a Kubernetes cluster that doesn't support dual-stack networking, but the OCI subnet does support dual-stack, the NLB creation fails with:

Invalid listener: TCP-443-IPv6 is not associated with a backendset

Environment

• OCI Cloud Controller Manager version: v1.33.0
• Kubernetes version: v1.34.x / v1.35.x
• OCI subnet: Dual-stack (has both IPv4 and IPv6 CIDR blocks)
• Kubernetes cluster: Single-stack IPv4 (no IPv6 pod network configured)

Steps to Reproduce

1. Deploy Kubernetes cluster without dual-stack networking (IPv4 only pods)
2. Use an OCI subnet that has both IPv4 and IPv6 CIDR blocks
3. Create a LoadBalancer service with:

   apiVersion: v1
   kind: Service
   metadata:
     name: my-service
     annotations:
       oci.oraclecloud.com/load-balancer-type: "nlb"
   spec:
     type: LoadBalancer
     ipFamilyPolicy: PreferDualStack
     # Kubernetes assigns ipFamilies: [IPv4] since cluster doesn't support IPv6
     ports:
       - port: 443
         targetPort: 443
   

Expected Behavior

The CCM should create an IPv4-only NLB since the service's ipFamilies field is [IPv4].

Actual Behavior

The CCM attempts to create IPv6 listeners (based on subnet capabilities) but only creates IPv4 backend sets (based on ipFamilies), causing a mismatch error.

Root Cause

In getLbListenerBackendSetIpVersion(), the PreferDualStack case returns [IPv4, IPv6] when the subnet supports both, completely ignoring the ipFamilies parameter:

case string(v1.IPFamilyPolicyPreferDualStack):
    // ... subnet checks ...
    return []string{IPv4, IPv6}, nil  // Ignores ipFamilies!

The ipFamilies field is the authoritative specification of what IP families a service uses. The ipFamilyPolicy only influences how ipFamilies gets populated when not explicitly set.

Proposed Fix

Modify the PreferDualStack case to respect ipFamilies by only including IP versions that are both specified in ipFamilies AND supported by the subnet.

Start at getLbListenerBackendSetIpVersion() and trace how its returned IP versions are used to create NLB listeners and backend sets. Reproduce the IPv4-only service on a dual-stack subnet, then verify that PreferDualStack returns only IP families present in ipFamilies and that listener and backend-set families match.