Configurable session affinity for load balancer rules #733

Summary

datum-cloud/enhancements#884 requires configurable session affinity for the network load balancer: None, ClientIP and ClientIPAndProtocol. Today the gateway has one fixed behaviour. It picks a backend from the client's address and port, within a table chosen by protocol, VIP and port, which is the 5-tuple hash #884 names as the default. There is no way to pin a client to one backend across connections.

Affinity only changes what goes into the hash, so it stays stateless. Every gateway node must use the same setting for a rule, or a flow that moves between nodes lands on a different backend.

Acceptance criteria

• NetworkRule has an affinity setting with the values None, ClientIP and ClientIPAndProtocol. None is the default and keeps today's behaviour
• ClientIP sends every connection from one client address to the same backend, across ports and across rules that share a backend set
• ClientIPAndProtocol sends every connection from one client address and protocol to the same backend
• Changing a rule's affinity takes effect on every gateway node without a restart
• Tests cover each mode, and confirm two gateway nodes pick the same backend for the same client
• The docs say that affinity holds only while the backend set is unchanged, with the same bound of about 1/N of clients moved per change

Phase 2 of #698. #696 exposes the setting to tenants.