[azure] Implement excess IP release support

[jaredledvina]

• For first time contributors, read Submitting a pull request
• All code is covered by unit and/or runtime tests where feasible.
• All commits contain a well written commit description including a title,
  description and a Fixes: #XXX line if the commit addresses a particular
  GitHub issue.
• If your commit description contains a Fixes: <commit-id> tag, then
  please add the commit author[s] as reviewer[s] to this issue.
• All commits are signed off. See the section Developer’s Certificate of Origin
• Provide a title or release-note blurb suitable for the release notes.
• Thanks for contributing!

Implements excess free-IP release for the Azure IPAM allocator, mirroring the
existing AWS ENI release feature. It is gated behind a new opt-in operator flag
and is a strict no-op when disabled (the default).

• --azure-release-excess-ips (default false) enables the feature.
• --azure-excess-ip-release-delay (default 180) is the grace period before a
  free IP marked as excess is released.

The work is split into three commits:

1. SDK support: UnassignPrivateIpAddressesVM/UnassignPrivateIpAddressesVMSS
   on the Azure client (and mock), and tracking of the IPConfiguration name on
   each address so VMSS releases can translate IPs to IPConfiguration names.
   Primary IPConfigurations are refused pre-flight (fail-closed) because Azure
   rejects an update that drops the primary and fails the whole batch.
2. IPAM node operations: PrepareIPRelease selects free IPv4 addresses
   (Succeeded, non-primary, unused) on the interface with the most releasable
   IPs using deterministic sorted-by-ID selection; ReleaseIPs dispatches to
   the VM or VMSS path and updates the operator cache after a successful
   release.
3. Operator wiring: the new flags are registered in the Azure allocator cell and
   passed through to the IPAM node manager.

operator: Add support for releasing excess free IP addresses on Azure IPAM, gated behind the new --azure-release-excess-ips flag (disabled by default).