Prepare for release v1.10.10

[joestringer]

Summary of Changes

Minor Changes:

• Locally allocated identities are now restored during restart, helping avoid transient drops due to identity changes in policies. (Backport PR v1.10 backports 2022-04-11 #19404, Upstream PR daemon: Restore old CIDR identities #19360, @jrajahalme)

Bugfixes:

• cmd: Fix issue where a ConfigMap value of {} was parsed as map["{}":""]. (Backport PR v1.10 backports 2022-03-29 #19254, Upstream PR cmd: Fix issue where a ConfigMap value of {} was parsed as map["{}":""]. #19172, @gandro)
• Fix a bug where a backend pod can be selected by a local redirect policy deployed in a different namespace if the local redirect policy was deployed first. (Backport PR v1.10 backports 2022-03-29 #19254, Upstream PR pkg/redirectpolicy: Add missing namespace check in pod update handler #19193, @aditighag)
• Fix bug that would cause some pod traffic to leave through the wrong interface if --aws-release-excess-ips is used and masquerading disabled. (Backport PR v1.10 backports 2022-04-01 #19296, Upstream PR routing: Fix the incorrect deletion of IP rules #19162, @pchaigno)
• Fix bug where FQDN policy calculation could trigger a deadlock in cilium-agent (Backport PR v1.10 backports 2022-03-29 #19254, Upstream PR selectorcache: Move identity alloc/release outside of critical section #19031, @joestringer)
• Fix bug where the Cilium DNS proxy slows down significantly (and even OOMs) due to lock contention from spawning many goroutines when handling bursty DNS traffic (Backport PR v1.10 backports 2022-04-12 #19416, Upstream PR Use RLock while reading data in DNS proxy #19336, @nebril)
• Fixed node init in RKE (Backport PR v1.10 backports 2022-04-12 #19416, Upstream PR fix(helm): use a directory to store bootstrap time #19286, @raphink)
• helm: Removed unnecessary Kubernetes RBAC permissions for cilium-agent (Backport PR v1.10 backports 2022-03-29 #19254, Upstream PR helm: Remove Unnecessary RBAC Permissions for Agent #19053, @nathanjsweet)
• helm: Update Clustermesh-APIServer RBAC permissions for platforms (like Openshift) that have the OwnerReferencesPermissionEnforcement admission controller enabled. (Backport PR v1.10 backports 2022-03-29 #19254, Upstream PR helm: Add RBAC Permissions to Clustermesh APIServer Clusterrole #19071, @nathanjsweet)
• hubble/recorder: Sanitize pcap filename (Backport PR v1.10 backports 2022-03-29 #19254, Upstream PR hubble/recorder: Sanitize pcap filename #18612, @gandro)
• wireguard: Reject duplicate public keys (Backport PR v1.10 backports 2022-04-12 #19416, Upstream PR wireguard: Reject duplicate public keys #19344, @gandro)

CI Changes:

• jenkinsfiles: Update calls to Quay API (Backport PR v1.10 backports 2022-03-29 #19254, Upstream PR jenkinsfiles: Update calls to Quay API #19229, @pchaigno)
• test: Wait until host EP is ready (=regenerated) (Backport PR v1.10 backports 2022-04-05 #19331, Upstream PR test: Wait until host EP is ready (=regenerated) #18859, @brb)
• Use docker manifest inspect to wait for images instead of using quay API (Backport PR v1.10 backports 2022-04-05 #19331, Upstream PR workflows: Use docker manifest inspect for waiting images #19307, @YutaroHayakawa)
• workflows: Update call to Quay API (Backport PR v1.10 backports 2022-03-29 #19254, Upstream PR workflows: Update call to Quay API #19228, @pchaigno)

Misc Changes:

• Add a 'Limitations' section to 'External Workloads'. (Backport PR v1.10 backports 2022-04-12 #19416, Upstream PR Add a 'Limitations' section to 'External Workloads'. #19366, @bmcustodio)
• add context when return errors during datapath initialization (Backport PR v1.10 backports 2022-03-29 #19254, Upstream PR add context when return errors during datapath initialization #18011, @kerthcet)
• build(deps): bump actions/cache from 3.0.0 to 3.0.1 (build(deps): bump actions/cache from 3.0.0 to 3.0.1 #19272, @dependabot[bot])
• build(deps): bump actions/cache from 3.0.1 to 3.0.2 (build(deps): bump actions/cache from 3.0.1 to 3.0.2 #19392, @dependabot[bot])
• build(deps): bump actions/checkout from 3.0.0 to 3.0.1 (build(deps): bump actions/checkout from 3.0.0 to 3.0.1 #19446, @dependabot[bot])
• build(deps): bump KyleMayes/install-llvm-action from 1.5.1 to 1.5.2 (build(deps): bump KyleMayes/install-llvm-action from 1.5.1 to 1.5.2 #19324, @dependabot[bot])
• ci: Pin down image for the documentation workflow (Backport PR v1.10 backports 2022-04-12 #19416, Upstream PR ci: Pin down image for the documentation workflow #19356, @qmonnet)
• docs: Clarify use of the eni.subnetTagsFilter option (Backport PR v1.10 backports 2022-04-05 #19331, Upstream PR docs: Clarify use of the eni.subnetTagsFilter option #19276, @gandro)
• envoy: Limit accesslog socket permissions (Backport PR v1.10 backports 2022-04-12 #19416, Upstream PR envoy: Limit accesslog socket permissions #19190, @jrajahalme)
• ipcache: Add test asserting out-of-order Kubernetes events (Backport PR v1.10 backports 2022-04-05 #19331, Upstream PR ipcache: Add test asserting out-of-order Kubernetes events #19258, @christarazi)
• Test runtime cilium in container (take two) (Backport PR v1.10 backports 2022-04-11 #19404, Upstream PR Test runtime cilium in container (take two) #19310, @jrajahalme)
• test: Fix whitespace in docker-run-cilium (Backport PR v1.10 backports 2022-04-11 #19404, Upstream PR test: Fix whitespace in docker-run-cilium #19358, @jrajahalme)
• vendor: pull in the latest changes from github.com/vishvananda/netlink (Backport PR v1.10 backports 2022-04-11 #19404, Upstream PR vendor: pull in the latest changes from github.com/vishvananda/netlink #18618, @aditighag)
• wireguard: Fix invalid bits when agent init (Backport PR v1.10 backports 2022-03-29 #19254, Upstream PR wireguard: Fix invalid bits when agent init #19118, @junnplus)

Other Changes:

• install: Update image digests for v1.10.9 (install: Update image digests for v1.10.9 #19239, @aanm)