felix: support anycast failover for LoadBalancer VIPs

[Subhom1]

Description

Adds opt-in anycast failover for LoadBalancer VIPs using:

projectcalico.org/anycast: "true"

When no local endpoint is available:

• iptables traffic accepted by Calico policy bypasses kube-proxy’s no-endpoint rejection and follows normal routing.
• The BPF dataplane falls through to routing instead of returning ICMP unreachable.
• Rules are limited to the Service’s LoadBalancer VIPs, protocols, and ports.

Fixes #13136.

Testing

• go test ./felix/rules
• go test ./felix/calc
• go test ./felix/bpf/proxy
• Linux dataplane compile-only test
• Linux dataplane suite: 982 passed; 12 unrelated failures due to missing generated XDP fixtures

Release note

Support opt-in anycast failover for LoadBalancer VIPs when local endpoints are unavailable.

[CLAassistant]

All committers have signed the CLA.

[fasaxc]

Haven't reviewed the code itself, but API-wise, I'm not sure anycast is the right framing; it's your use case, but it doesn't really explain what the flag does. This should be something like lb.projectcalico.org/no-endpoints-action: Drop | Forward. We already use the lb.projectcalico.org for Maglev annotations.