Add egress to Goldmane and Guardian network policies

[caseydavenport]

Description

On Calico OSS clusters, the Goldmane and Guardian pods lost connectivity once the network policy tier was enabled for OSS in 3.32. The calico-system tier's default-deny policy started applying to these pods, but their policies only defined ingress rules, so their egress was dropped: DNS to CoreDNS, the Kubernetes API, and Guardian's tunnel to the management cluster. This showed up as denied flows in Whisker and broke flow visibility on Calico Cloud-connected clusters.

This adds the missing egress:

• Goldmane: DNS, the Kubernetes API, and (in managed clusters) Guardian. These destinations are all in-cluster, so the policy stays fully locked down.
• Guardian: DNS and the Kubernetes API, plus a Pass for the tunnel to the management cluster. The management cluster address is environment-specific and often a hostname, which OSS policy can't express as a selector, so we defer it to the cluster's default posture - the same approach the enterprise policy already uses.

Enterprise policy is unchanged.

Fixes #4804
Related: #4772

Release Note

Fixes a regression where the Goldmane and Guardian pods were unable to reach DNS or the management cluster, which could break flow visibility (including on Calico Cloud-connected clusters).

For PR author

• Tests for change.
• If changing pkg/apis/, run make gen-files
• If changing versions, run make gen-versions

For PR reviewers

A note for code reviewers - all pull requests must have the following:

• Milestone set according to targeted release.
• Appropriate labels:
  • kind/bug if this is a bugfix.
  • kind/enhancement if this is a a new feature.
  • enterprise if this PR applies to Calico Enterprise only.