When the root net ns has "eth0", dummy CNI returns errror "failed to
create dummy: file exists"

The fix is to create the dummy interface directly in the pod net ns

Signed-off-by: Yuan Liu <liuyuan@google.com>

Signed-off-by: Balazs Nemeth <bnemeth@redhat.com>

Fixes 01a94e1

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>

portmap iptables backend uses `-m addrtype --dst-type LOCAL`
and a common chain (CNI-HOSTPORT-DNAT) for both hostPort and hostIP/hostPort.

Before this commit, nftables backend was using 2 separate chains,
`hostip_hostports` and `hostports`. The goal was to avoid using
`fib daddr type local` before we jump to `hostip_hostports`,
but this is a behavior change compared to iptables backend,
and a security issue (hostIP: 1.1.1.1 / hostPort: 53).
Also while switching from input to prerouting hook, we forgot to
add the fib lookup for `hostports`, rendering the nftables backend half broken.

To allow transparent upgrades and avoid running the fib lookup twice,
we use an intermediate chain (`hostports_all`)
```
chain hostports_all {
    jump hostip_hostports
    jump hostports
}
```

Long-term we want to remove `hostip_hostports`,
so all new rules are created in the `hostports` chain.

We can't use implicit chains (`jump { jump hostip_hostports; jump hostports }`)
as it's not supported by knftables.Fake yet.

Fixes 9296c5f
Fixes 01a94e1

Signed-off-by: Etienne Champetier <e.champetier@ateme.com>