test(e2e): the data-plane capture has no conntrack read filtered by ClusterIP #4623

When a pod cannot reach a ClusterIP, the e2e data-plane capture has no conntrack view of the traffic to that ClusterIP. The per-node conntrack reads filter only on the pod IP (grep -F <podIP>). The only read filtered by destination VIP is conntrack -L -d <LB IP>, and that runs only in the LoadBalancer path.

In the failure #3689 describes, a pod timing out against 10.96.0.1, the entries that would show whether the kernel saw the connection and where it was translated to are exactly the ones filtered by destination. #3689's fix makes the capture dump the full cilium-dbg bpf lb list on every affected node, which covers the service map side but not conntrack.

Fix shape: a per-node conntrack -L -d <VIP> for the VIPs a failing pod was trying to reach. That needs a decision on which VIPs to read: only default/kubernetes, every ClusterIP in the service CIDR the failing pod's namespace uses, or the whole service CIDR with a size cap. The read goes through the collector's wall-clock budget like every other kubectl call there.