support new SGPP standard mode

[M00nF1sh]

What type of PR is this?
feature
cleanup

Which issue does this PR fix:
This PR supports calico network policy & NodeLocalDNS for Pods with SecurityGroup with a new traffic mode.

What does this PR do / Why do we need it:

1. This PR introduces a new knob called POD_SECURITY_GROUP_ENFORCING_MODE, which decides the traffic mode "security group for pods" feature.
   The possible settings of POD_SECURITY_GROUP_ENFORCING_MODE are:
   • strict: all inbound/outbound traffic from pod with security group will be enforced by security group rules.
     • this is the default mode, and is the existing behavior before this change.
   • standard: the traffic of pod with security group behaves same as pods without security group, except that each pod occupies dedicated ENI
     • inbound traffic to pod with security group from another host will be enforced by security group rules.
     • outbound traffic from pod with security group to another host in same VPC will be enforced by security group rules.
     • outbound traffic from pod with security group to IP address outside VPC
       • if externalSNAT enabled, traffic won't be SNATed, thus will be enforced by security group rules.
       • if externalSNAT disabled, traffic will be SNATed via eth0, thus will only be enforced by security group associated with eth0.
     • inbound/bound traffic from another pod on same host or another service on same host(such as kubelet/nodeLocalDNS) won't be enforced by security group rules.
2. This PR did several refactor to make original code more clean and maintainable.

If an issue # is not available please add repro steps and logs from IPAMD/CNI showing the issue:

Testing done on this change:

1. rewrote test cases for driver.go
   • increases test coverage from 34% to 95%.
   • actually test API calls instead of abuse gomock.any
   • fixes old broken tests

Automation added to e2e:

Will this PR introduce any new dependencies?:

N/A

Will this break upgrades or downgrades. Has updating a running cluster been tested?:

Does this change require updates to the CNI daemonset config files to work?:

No, the default value of "POD_SECURITY_GROUP_ENFORCING_MODE" if not set is "standard".

Does this PR introduce any user-facing change?:

Introduce a new knob named POD_SECURITY_GROUP_ENFORCING_MODE to decide the traffic mode for security group for pods feature. 

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.

[jayanthvn]

@M00nF1sh - Can you please run "make format"?

[joebowbeer]

@M00nF1sh The description contains conflicting statements. I assume this one is wrong:

Does this change require updates to the CNI daemonset config files to work?:

No, the default value of "POD_SECURITY_GROUP_ENFORCING_MODE" if not set is "standard".

I assume default is strict to agree with previous statement in description.