feat: calico to provide CNI

[vsoch]

@milroy this is ready to test when you have bandwidth, which I don't think needs to be soon. For context, we want to restore this PR in the updated (v2) usernetes setup. The reason is to hopefully avoid this setting:

sudo tee /etc/sysctl.d/99-usernetes.conf <<EOF >/dev/null
net.ipv4.conf.default.rp_filter = 2
EOF

sudo sysctl --system

Ping me if/when you want to test it out. I suspect we need to bring up two nodes and test networking, test the newer release, and then debug why the quay.io (image they provide) has an ssl error (hence using an image I pushed to our registry). When it is working for our setup we will want to redo the work on the master branch (that mirrors what upstream has) and open a pull request. Maybe you can do that this time, because I haven't had luck with Akihiro accepting any of my PRs. After that I'd like to fully test and merge #2 so we don't fall too behind.

No urgency on any of this - just putting it here so it's around as a starting template when needed.