daemon: Postpone ipcache upserts until after policy changes have been regenerated by endpoints.
daemon: Postpone ipcache upserts until after policy changes have been regenerated by endpoints.

Move ipcache CIDR upserts and releases to the policy reaction queue,
where upserts can be executed after regenerations have been completed,
i.e. after endpoint policy maps have been updated. This way IP
addresses are mapped to newly allocated identities only after endpoint
policy maps are ready to classify them.

Correspondingly, on deletes the to-be-deleted CIDR identities are
first deleted from ipcache so that when they are deleted from endpoint
policy maps they are no longer used in classification. Releases of
CIDR identities must still be serialized with ipcache upserts via the
policy reaction queue so that they are executed in the same order
w.r.t. ipcache upserts as policy deletes and adds.

Signed-off-by: Jarno Rajahalme <0f1ab0ac7dffd9db21aa539af2fd4bb04abc3ad4@covalent.io>

tklauser/cilium,tklauser/cilium,cilium/cilium,michi-covalent/cilium,michi-covalent/cilium,michi-covalent/cilium,cilium/cilium,tgraf/cilium,tgraf/cilium,tgraf/cilium,cilium/cilium,cilium/cilium,tgraf/cilium,michi-covalent/cilium,tklauser/cilium,tklauser/cilium,michi-covalent/cilium,tgraf/cilium,tgraf/cilium,tklauser/cilium,cilium/cilium