Canonicalize IP6EXTERNALRANGE to fix this warning:

[=] [cilium-test-2] Test [all-egress-deny-knp] [3/21]
I0526 13:40:09.838874       1 warnings.go:110] "Warning: spec.egress[0].to[1].ipBlock.cidr: IPv6 CIDR value \"fd00:10:64::ffff:00/112\" should be in RFC 5952 canonical format (\"fd00:10:64::ffff:0/112\")"

Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>

Recently, we started replacing real external targets (such as
one.one.one.one) in test workflows with fake ones to increase robustness
in case the servers that we don't control go down.

Commit 6982ed9 (".github/workflows: Use fake targets in
conformance-kind-proxy-embedded") mentions that the new GitHub actions
kind-external-network and kind-external-targets don't work with
little-vm-helper. The reason is that those actions, as implemented
initially, called into Docker from the GHA context, but Docker runs
inside a VM in LVH-based workflows. The change made here allows those
GitHub actions to SSH into the VM before running Docker commands.

To support Docker volume mounts both on the host and inside the VM, use
relative paths and cd /host in the VM to get into the same directory.

Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>

Enabling fake external targets in LVH-based workflows makes this IPv6
NodePort test fail:

north-south-loadbalancing-with-l7-policy-port-range/outside-to-nodeport

tcp_checksum_complete fails in tcp_v6_rcv, and TCP_MIB_CSUMERRORS
increases with every IPv6 SYNACK.

While it's not clear why it passed in other workflows and how setting
the bridge name explicitly affects the checksums, adding this magic line
is sufficient to make this test pass in LVH-based workflows.

The bridge name chosen is not arbitrary, and it matches the config used
by contrib/scripts/kind.sh.

Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>

check-encryption-leaks.bt treats everything under fd00::/8 as pod
traffic. This CIDR includes the actual external and node-to-node traffic
in configurations with fake external target.

Change the IPv6 subnet in those configurations to match the default used
by contrib/scripts/kind.sh.

Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>

.github/actions/kind-external-targets/action.sh patches the cluster-wide
DNS to be able to resolve the hostnames of the fake external targets in
the cilium TLD.

Some LVH-based workflows use node-local DNS that doesn't know about the
cilium TLD, therefore, it'll fail to resolve the fake external targets
once they are enabled for LVH-based workflows.

Patch the node-local DNS config to forward requests in the cilium TLD to
the cluster-wide DNS server, which is capable of resolving the hostnames
of the fake external targets.

Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>

EXTRA_CLI_FLAGS is formed as an array, each element corresponding to a
command line argument. However, if an argument contains spaces, we have
to quote the element of the array manually. Alleviate this burden by
applying shell quoting with @q when expanding the array into a string.

Signed-off-by: Maxim Mikityanskiy <maxim@isovalent.com>