[release/v1.4] Cherry-pick Canal/Calico iptables backend and Azure CCM changes

[xmudrii]

What this PR does / why we need it:

This PR cherry-picks several fixes from the master to the release/v1.4 branch:

• Mount /usr/share/ca-certificates in the Azure CCM (part of Mount /usr/share/ca-certificates in the Azure CCM, update Flatcar to 3227.2.1, enforce NFT backend, and improve Terraform configs #2331)
• Set iptables backend to NFT for Canal and Calico VXLAN on Flatcar clusters (Set iptables backend to NFT for Canal and Calico VXLAN on Flatcar clusters #2301)
• Enforce NFT iptables backend for Canal on RHEL (part of Mount /usr/share/ca-certificates in the Azure CCM, update Flatcar to 3227.2.1, enforce NFT backend, and improve Terraform configs #2331)

What type of PR is this?

/kind bug

Does this PR introduce a user-facing change? Then add your Release Note here:

- Mount `/usr/share/ca-certificates` to the Azure CCM container to fix CrashLoopBackoff on clusters running Flatcar
- Enforce the NFT iptables backend for Canal and Calico VXLAN on RHEL
- Set iptables backend (`FELIX_IPTABLESBACKEND`) to `NFT` for Canal and Calico VXLAN on clusters running Flatcar Linux. For non Flatcar clusters, iptables backend is set to Auto, which is the default value and results in Calico determining the iptables backend automatically. The value can be overridden by setting the `iptablesBackend` addon parameter (see the PR description for an example).

Documentation:

NONE

[kubermatic-bot]

Skipping CI for Draft Pull Request.
If you want CI signal for your change, please convert it to an actual PR.
You can still manually trigger a test run with /test all

[kron4eg]

/lgtm
/approve

[kubermatic-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: kron4eg

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [kron4eg]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[kubermatic-bot]

LGTM label has been added.

Git tree hash: 6c72df319b986e32c474710b7fafc726cdf9984b