Make NetworkRule's protocol field extensible to protocols without ports #734

Summary

datum-cloud/enhancements#884 requires that support for more protocols can be added later without a breaking change to the configuration API. The future protocols it names are ESP and GRE (IPsec VPN termination), ICMP (diagnostic passthrough) and SCTP.

NetworkRule can't express most of them today. Its protocol is an enum of tcp and udp, and its port is required, but ESP, GRE and ICMP have no ports. Adding them later would mean making a required field optional, which breaks clients. This has to change before the public API (#696) is fixed on top of NetworkRule.

This issue covers the API shape only. The datapath for the new protocols is future work.

Acceptance criteria

• The protocol field is an enum that can gain values without breaking existing clients
• The port is optional, and validation requires it only for protocols that have ports (tcp, udp and later sctp)
• Admission refuses a protocol the datapath can't serve yet, with a message that says so
• Existing tcp and udp rules keep working unchanged
• The design notes how a rule for a protocol without ports picks a backend (client and VIP address only), so the datapath work doesn't need another API change

Phase 2 of #698. Blocks #696.