Support routing to external IPs behind service

[jdn5126]

What type of PR is this?
bug

Which issue does this PR fix:
#1910

What does this PR do / Why do we need it:
This PR adds a new environment variable, AWS_EXTERNAL_SERVICE_CIDRS, where customers can specify IPV4 CIDRs outside of VPC that are reachable via service IP. This is necessary to route to these endpoints via service IP from secondary ENIs (#1910).

For each CIDR, an IP rule is installed (with a priority higher than the from-container rule) to route to the CIDR via main routing table. An example rule is:

1535:   from all to A.B.C.D lookup main

Currently, every time AWS_EXTERNAL_SERVICE_CIDRS is changed, the aws-node pod restarts, which is why the implementation for this function is in IPAMD node initialization. In the future, if a ConfigMap is used (#2102 is implemented), then operators will need to manually restart the aws-node container after modifying the environment variable.

If a solution can be implemented one day that dynamically detects this case and ensures proper routing, this environment variable will be deprecated.

If an issue # is not available please add repro steps and logs from IPAMD/CNI showing the issue:
N/A

Testing done on this change:
Unit tests are added to cover new functions. I manually verified functionality and ensured that all existing integration tests pass. I considered adding an integration test case, but decided against it as it would require setting up communication outside of VPC or requiring node IPs to be public, both of which we want to avoid. The unit tests cover that we add and delete the IP rules as expected, and we know that routing works when IP rules are present.

Automation added to e2e:
N/A

Will this PR introduce any new dependencies?:
No

Will this break upgrades or downgrades. Has updating a running cluster been tested?:
This PR will not break upgrades or downgrades. A running cluster has been tested.

Does this change require updates to the CNI daemonset config files to work?:
No

Does this PR introduce any user-facing change?:
Yes

Added AWS_EXTERNAL_SERVICE_CIDRS to resolve issues routing to endpoints outside of VPC backed by service.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.