This change introduces a Ztunnel Discovery Service (ZDS) server in
cilium. The server can communicate cilium-managed endpoints to ztunnel
in order for ztunnel to be able to setup its inpod proxies.

The ZDS server implementation that is added here provides an API, which
can be consumed by 3rd party code to enroll/disenroll endpoints with
ztunnel.

For this to be possible the endpoint.Endpoint object now has a field to
store the pinned netns path of a pod. This field is set from the cni
plugin on CNI ADD events.

For reference, the ZDS protocol can be found here:
https://github.com/istio/ztunnel/blob/master/proto/zds.proto

Signed-off-by: Robin Gögge <[email protected]>
Co-authored-by: Quang Nguyen <[email protected]>

Introduce a reconciler-based system for managing endpoint enrollment to ztunnel
based on namespace membership. The implementation uses StateDB to maintain an
EnrolledNamespace table that tracks which namespaces should have their endpoints
participating in ztunnel's mTLS capabilities.

The reconciler subscribes to the endpoint manager and reacts to endpoint lifecycle
events, enrolling endpoints when they are created in enrolled namespaces and
disenrolling them upon deletion. On startup, it waits for endpoint restoration to
complete before sending an initial snapshot of all eligible endpoints in enrolled
namespaces to ztunnel, ensuring consistency after agent restarts.

Endpoints are filtered to exclude those without network namespace paths and ztunnel
pods themselves to prevent self-enrollment. When a namespace is added to the enrolled
set, all existing endpoints in that namespace are enrolled in bulk. Conversely, when
a namespace is removed, all its endpoints are disenrolled. This table-driven approach
provides declarative enrollment management and simplifies recovery from transient
failures through automatic reconciliation.

Signed-off-by: Robin Gögge <[email protected]>
Co-authored-by: Quang Nguyen <[email protected]>