pkg/identity: Watch and update labels for the host

[pchaigno]

This commit adds a k8s watcher for label updates on the host. It allows node network policies to select the nodes based on labels. For now, the same label filters are used for the nodes as for the labels.

Whatever the labels it receives, because we know there can be only one host endpoint per node, the host endpoint will always retain its security ID of 1. We therefore don't need to reload the host endpoint's datapaths on label updates.

[coveralls]

Coverage decreased (-0.02%) to 36.991% when pulling 85f90ff on pr/pchaigno/node-labels into 7e328b1 on master.

[tgraf]

I'm not sure I fully understand yet what this will enable. This will create an identity id 1 with labels which will always remain in the scope of the node as it is reserved. It will thus enable to refer to the local node by its own labels.

I assume this intends to enable referring to other nodes by node labels at some point. That will require to use a non-reserved identity and to allocate an identity instead based on the node labels found on the node.

It will also require to:

• Represents the node IPs as CiliumEndpoint and insert them into the kvstore ipcache
• Individual nodes will no longer have to maintain the ipcache based on CiliumNode or Node events but can instead get their ipcache filled via the CiliumEndpoint or kvstore updates.

[tgraf]

I assume this intends to enable referring to other nodes by node labels at some point. That will require to use a non-reserved identity and to allocate an identity instead based on the node labels found on the node.

Discussed with Paul offline. This PR is specifically limited in scope to enable to select what node a policy applies to.

[pchaigno]

retest-runtime