[QE] Restrict downloads during install, setup, and start

[jsliacan]

Re: #3608, specifically this comment.

Suggestion

1. Clearly identify what needs to be downloaded/accessed over the internet in order to turn a release download into a running cluster.
2. Only allow those connections to be made by the cluster during the process.
3. Make this an integration test - CRC use under restricted network access.

Benefits

• This would have caught the issue where crc-admin-helper and vfkit are downloaded (it's the case in 2.16.0 and 2.17.0 releases).
• If implemented properly, this will serve as a much more comprehensive "user scenario" than just checking the case in [BUG] [Mac] 2.17.0 release does not use admin-helper and vfkit binary from installer #3608 .