feat: add transparent-tunnel CNI mode for GPS VFP enforcement (Windows)

[alam-tahmid]

Reason for Change:
Adds Windows support for the transparent-tunnel CNI operating mode, enabling GlobalPodSecurity (GPS) VFP enforcement. Companion to #4319 (Linux).

GPS requires pod traffic to traverse the Azure VFP pipeline so NSG rules can be enforced at the pod level. On Windows with HNS, pod traffic normally bypasses VFP via direct L2 switching. The transparent-tunnel mode adds /32 host routes via the gateway for each pod IP,
forcing traffic through VFP for inspection.

Key changes:

• Per-pod /32 routes added on endpoint create, removed on delete
• Fail-safe rollback: partial route failure rolls back routes AND HNS endpoint
• HNSv1 explicitly rejected for transparent-tunnel mode
• Fixed DeleteEndpointStateless in manager.go (was hardcoding mode, skipping GPS cleanup)

Issue Fixed:

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• relevant PR labels added

Notes:
 - Depends on #4319 (Linux transparent-tunnel) for shared opModeTransparentTunnel constant

• GPS logic in dedicated transparent_tunnel_endpoint_windows.go matching Linux's file pattern
• 15 unit tests covering gateway selection, route add/rollback, and route delete
• No shared infrastructure (unlike Linux's iptables/ip-rule) — /32 routes are 1:1 per pod, no race conditions

[github-actions]

This pull request is stale because it has been open for 2 weeks with no activity. Remove stale label or comment or this will be closed in 7 days