feat: add ConnectionTrackingSpec to ENIConfig

[Sayrus]

What type of PR is this?

feature

Which issue does this PR fix?:

Implements #2677 (stale issue)

What does this PR do / Why do we need it?:

In 2023, AWS introduced configurable idle timeout. Reducing this timeout allows reducing conntrack usage.

This change allows customizing timeout on ENI objects created by the VPC CNI. This allows changes such as reducing UDP Stream timeout which can be useful for cluster overwhelming security groups connection tracking. (e.g. clusters doing many DNS requests without node cache)

Use-case: aws/karpenter-provider-aws#6826 (comment)

Testing done on this change:
Tested on a running EKS cluster to validate the previous behavior was unchanged (with and without prefix delegation, with and without UDP Idle timeouts set)

apiVersion: crd.k8s.amazonaws.com/v1alpha1
kind: ENIConfig
metadata:
  name: us-west-2b
spec:
  connectionTrackingSpec:
    udpStreamTimeout: 60

results in:

Will this PR introduce any new dependencies?:
No new external dependency.

Will this break upgrades or downgrades? Has updating a running cluster been tested?:

Upgrading the CRD is backward compatible with running aws-node. Setting new ENIs parameters usually requires rotating the node.

Downgrading the CRD after changes were made to ENIConfig will make the added fields disappear, allowing safe downgrades. Parameters set on existing ENIs are not removed unless ENIs or nodes are rotated. This matches the behavior of the existing securityGroups / subnets parameters.

Tested on a small cluster.

Does this change require updates to the CNI daemonset config files to work?:
Changes required are in user-provided configuration files (ENIConfig). No parameters or modifications to the DaemonSet are required.

Does this PR introduce any user-facing change?:

⚠️ This adds a new field to the ENIConfig CRD.

add support for connection tracking idle timeout in ENIConfig objects