Implement shared selector-based functionality for port groups and address sets, to be re-used by network policy, ANP, egress firewall, multicast and possibly other features in the future.

This is intended to

• update port groups on pod creation (network policy is the main use case, so the pod is isolated before it is started)
• share port groups and address set when possible (for performance, it is already implemented for network policy address sets)
• share code between features that update port groups and address sets based on selectors (mostly for pods and nodes, possibly services and other objects in the future)