FR: Kubernetes operator ingress HA (multiple replicas) tracking issue

### What are you trying to do?

This is the tracking issue for the Kubernetes operator's [network layer proxy's] HA work.

This will ensure that:

- a Kubernetes Service can be exposed to tailnet via multiple active proxies, to minimize downtime during proxy upgrades and other cluster events that require proxy Pod restarts

- multiple Kubernetes Services can be exposed on the same set of proxies (each with a unique tailnet identity (ACL tag)) to ensure that folks who want to expose larger number of Services don't need to have a tailnet device/proxy Pod for each

### How should we solve this?

- [x] add new netfilter rules (should allow dynamically inserting/removing firewall rules as new Services are added/removed)
- [x] update containerboot to dynamically update firewall as ingress config changes (proxy Pods should not get restarted when Services are added/removed
- [x] add operator's reconciler that knows how to create Tailscale VIPServices and ingress config as users create HA ingress Services
- [ ] Ensure that there aren't resource clashes on the same Tailscale Service https://github.com/tailscale/tailscale/issues/16035

### What is the impact of not solving this?

Downtime during restarts, number of proxy Pods/tailscale devices grow in parallel with number of Services that need be exposed

cc @ChaosInTheCRD