Allocate load balancer VIPs from a platform-managed pool #702

Summary

A NetworkRule's vipAddresses are whatever the writer puts there. Nothing allocates them, records who holds them, or stops two rules from claiming the same address. Once rules are tenant-writable (#696), a tenant could advertise any address, including one that belongs to someone else.

datum-cloud/enhancements#884 makes a load balancer regional, with an IPv6 address by default and optional reserved static IPv4. VIPs therefore come from platform-managed IPv6 and IPv4 pools per region, with each allocation recorded so admission can check it. This is the same gap #409 had for egress addresses, except these addresses are tenant-facing.

This issue covers the pools and the record of who holds each address. #735 covers the default IPv6 allocation and the IPv4 reservation flows built on them. #736 covers keeping each VIP inside its region.

Acceptance criteria

• Decide where the pools live and who owns the address space (infra host vars, a CR, or the higher-layer API from Public API for network load balancer #696)
• Each region has an IPv6 pool and an IPv4 pool
• A VIP is allocated to one owner in one region and recorded on a resource admission can read
• Admission (Rule authorization is wired but never enforced #366) rejects a NetworkRule whose VIP isn't allocated to the rule's owner
• VIPs are exported under the same controls as other platform GUA (default-deny export, RPKI ROA)

Phase 1 of #698. Depends on #366 for enforcement.