Add Router support & poolMemberNetwork for LB

[mweibel]

This change implements two new features in separate commits:

Pool Member Network for LoadBalancer

apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
kind: CloudscaleCluster
metadata:
  name: "${CLUSTER_NAME}"
  namespace: "${NAMESPACE}"
spec:
  # [...] rest of the spec [...]
  controlPlaneLoadBalancer:
    # network omitted -> public VIP (external API endpoint)
    poolMemberNetwork: "${CLUSTER_NAME}-cp"

When specifying a poolMemberNetwork on the controlPlaneLoadBalancer, the LoadBalancer Members get created with the Network->Subnet specified to what has been configured. This allows us to better specify the LoadBalancer frontend and backend networks. The existing network setting will place the LoadBalancer frontend on that network when specified. If not specified, the LB will get a VIP from the public network instead.

Router
Implements the newly released Router feature for CAPCS.

apiVersion: infrastructure.cluster.x-k8s.io/v1beta2
kind: CloudscaleCluster
metadata:
  name: "${CLUSTER_NAME}"
  namespace: "${NAMESPACE}"
spec:
  # [...] rest of the spec [...]
  routers:
  - name: "${CLUSTER_NAME}-router"
    internetGateway: true  # enables SNAT for outbound internet access
    interfaces:
    - network: "${CLUSTER_NAME}"

A CloudscaleCluster can now be set up with 0-n routers, allowing for much more flexible and private network topologies. The accompanying new template router-nat places the control-plane and worker nodes in a private network and does not attach them to the public network. Using the router with internetGateway: true and set as the default gateway of the specified network, will enable the nodes to communicate with the internet while ingress is only permitted via the LB -> Kubernetes API server.

Reviewer notes
The govulncheck failure is because the specified Go version has some potential vulnerabilities fixed in a newer version. Fixing this would be part of a separate PR.