MapState keeps separate maps for allows and denies. There is no need to
delete a key with a known entry value from both maps, as we can observe
if the entry is a delete or an allow entry.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Add new generic container type set.Set optimized for cases where there
typically is only one value in the set. A singular member is stored
separately, while sets with more members use a map to store them.

Set is not a refecence value, like a map is, so whenever a Set is stored
by value (e.g., in a map as a value rather than via a pointer), the value
must be updated when the Set changes from holding n/one to multiple and
from multiple to n/one values.

Due to this added complexity the Set should only be used in cases where
there typically is at most one value, and the associated reduction in
allocations is critical for performance or for memory use.

The singular value is stored by reference in order to avoid the need for
an additional boolean field to tell if the singlular value member is
occupied or not. This saves about 10% of memory due to the 'set.Set'
itself being smaller and has roughly the same performance as an inline
value, when tested for interface member types.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>

Use the new 'set.Set' to store owners in MapStateEntry.

Extend MapStateEntry.String() to output the owners, dependents, and
listener priority. This eases unit test debugging going forward.

With this change the BenchmarkRegenerateCIDRDenyPolicyRules benchmark
runs ~10% faster and uses ~15% less memory with ~9% less allocs than with
the prior map only version.

Signed-off-by: Jarno Rajahalme <jarno@isovalent.com>