feat: add GlobalPodSecurity config plumbing

[alam-tahmid]

Reason for Change:
Add GlobalPodSecurity config plumbing to support forcing same-VM pod-to-pod traffic through Azure
VFP for NSG evaluation. This is the first of 3 PRs — it adds the config field, endpoint struct wiring, and default
conflist entries.

Issue Fixed:

Requirements:

• uses conventional commit messages
• includes documentation
• adds unit tests
• relevant PR labels added

Notes:
This is PR 1 of 3 for the GlobalPodSecurity feature:

1. This PR — Config plumbing (NetworkConfig → EndpointInfo → endpoint)
2. PR 2 — Linux iptables + policy routing implementation
3. PR 3 — Windows /32 host route implementation

The field defaults to false (no behavioral change until explicitly enabled).

[Copilot]

Pull request overview

This PR introduces GlobalPodSecurity configuration plumbing to carry a new boolean knob from CNI network config into endpoint metadata, and updates default CNI conflists to surface the option (defaulting to false).

Changes:

• Added globalPodSecurity to CNI NetworkConfig (JSON) and plumbed it into network.EndpointInfo.
• Extended network endpoint-related structs to carry GlobalPodSecurity.
• Added unit tests for config unmarshalling and createEpInfo propagation, and updated default Linux/Windows conflists to include the flag (set to false).

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
network/endpoint.go	Adds GlobalPodSecurity fields to endpoint and EndpointInfo structs.
cni/network/network.go	Wires NetworkConfig.GlobalPodSecurity into generated EndpointInfo.
cni/network/network_test.go	Adds coverage to ensure createEpInfo propagates the flag into EndpointInfo.
cni/netconfig.go	Adds GlobalPodSecurity to CNI JSON config (globalPodSecurity).
cni/netconfig_test.go	Adds JSON unmarshal tests for globalPodSecurity defaulting/values.
cni/azure-windows.conflist	Adds "globalPodSecurity": false to default Windows conflist.
cni/azure-linux.conflist	Adds "globalPodSecurity": false to default Linux conflist.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.