cni-server: clear iptables mark before doing masquerade

[zhangzujian]

• Make sure you have followed Kube-OVN Code Style.

What type of this PR

• Bug fixes

Which issue(s) this PR fixes:

Fixes bad checksum while accessing pods running on other nodes via service:

15:17:04.808484 IP (tos 0x0, ttl 64, id 36415, offset 0, flags [DF], proto UDP (17), length 170)
    192.168.129.203.18647 > 192.168.129.205.6081: [bad udp cksum 0x82d8 -> 0xa635!] Geneve, Flags [C], vni 0x3, options [class Open Virtual Networking (OVN) (0x102) type 0x80(C) len 8 data 00010021]
    IP6 (hlim 63, next-header UDP (17) payload length: 72) fd00:100:64::2.41375 > fd00:10:16::24.1053: [udp sum ok] UDP, length 64

WHAT

🤖 Generated by Copilot at bb1b85e

Add a new iptables chain for node port service traffic with local external policy. Refactor some iptables functions and rules in gateway_linux.go.

🤖 Generated by Copilot at bb1b85e

To handle node port traffic well
This pull request adds OvnNodePort shell
It also refactors rules
And some iptables tools
To make them more readable and swell

HOW

🤖 Generated by Copilot at bb1b85e

• Add a new iptables chain OvnNodePort to handle node port service traffic with external traffic policy set to Local (link, link, link, link, link, link, link, link)
• Extract a new function createIptablesChain from updateIptablesChain to simplify the logic of ensuring the iptables chain exists (link)
• Modify updateIptablesChain to use createIptablesChain for both the chain and its parent chain, and return early if the chain already exists (link)
• Use a short variable declaration for the error variable err in updateIptablesChain (link)
• Replace the iptables rules that nat packets marked by kube-proxy or kube-ovn with rules that return those packets, since they will be SNATed later by kube-proxy (link, link)
• Add the --random-fully option to the MASQUERADE rules if the iptables version supports it, which improves the performance and reduces the risk of port exhaustion (link, link)