fix(e2e): strict wireserver validation — fail fast on unexpected curl exits

[r2k1]

What this PR does / why we need it:

Tightens the e2e wireserver-block validator so it fails fast on any unexpected curl exit code from an unprivileged pod, instead of retrying for a minute and only failing if no acceptable exit code ever showed up.

Why

validateWireServerBlocked is a security check: pods must not be able to reach the wireserver IP (168.63.129.16). The previous implementation retried for 1 minute, passing the check if curl eventually returned exit 28 (timeout). Two problems with that:

1. It treats the result of a security check as something to wait out — but a successful curl from a pod is never a transient condition. It means FORWARD DROP/REJECT rules are missing right now, and the test should surface that immediately.
2. The retry loop bounded the budget by time, not by observations. If the first curl returned exit 0 (reachable) but the last one returned 28 (timeout), the test would pass while a real regression was present somewhere in the window.

What

• Whitelist exit codes 28 (FORWARD DROP timeout) and 7 (FORWARD REJECT refused) as the only valid "wireserver blocked" signals.
• Anything else fails loudly with full diagnostics: FORWARD chain, KUBE-FORWARD chain, iptables-save filter, and conntrack entries for the wireserver IP. This makes regressions trivial to triage from the test log.
• Retry the exec call only on transient kube-apiserver exec failures, never on the curl result itself — one observation of an unexpected exit code is enough to fail.

This is strictly more defensive than the original (which only accepted exit 28) because it also accepts REJECT-based blocks, while failing on every other class of regression instead of swallowing them.

Scope

e2e/validation.go only. Test-only change, no product code touched. Extracted from #8480.

Which issue(s) this PR fixes:

N/A — test-only hardening, no linked issue.

[Copilot]

Pull request overview

This PR tightens the e2e security validator that ensures unprivileged pods cannot reach the Azure WireServer IP (168.63.129.16), changing it from “retry until timeout exit code appears” to “fail fast on any unexpected curl result,” while still retrying transient Kubernetes exec failures.

Changes:

• Accept curl exit codes 28 (timeout/DROP) and 7 (connect failed/REJECT) as the only valid signals that WireServer is blocked.
• Stop retrying based on curl outcomes; instead, fail immediately on any other curl exit code.
• Add richer failure diagnostics (FORWARD + KUBE-FORWARD chain, iptables-save filter excerpt, conntrack entries) when an unexpected exit code occurs.

[timmy-wright]

This would be easier to read with a list of allowable exit codes rather than a map. The constant time lookup benefit we get below doesn't seem worth it given the length of time these tests take to run.