fix(dra): restrict external usbip access

[yaroslavborbat]

Description

Added a CiliumClusterwideNetworkPolicy for virtualization-dra USB/IP gateway nodes. The policy denies access to the USB/IP port from outside the cluster and from cluster nodes that are not marked as USB gateway nodes.

Why do we need it, and what problem does it solve?

USB/IP runs on the node network and exposes the USB/IP daemon port on node interfaces. Without network restrictions, a publicly reachable node interface could expose shared USB devices to unauthorized consumers.

What is the expected result?

The USB/IP daemon port is reachable only from cluster nodes marked as USB gateway nodes. External traffic and traffic from non-gateway cluster nodes is denied by Cilium host policy.

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: module
type: fix
summary: "Restricted unauthorized access to the virtualization USB/IP gateway port."