The ServiceCIDR API is beta (and thus available by default) in k8s 1.31, but it will not work correctly in OCP, because (among other things) we do not support dynamically updating ovn-kubernetes with changes to the service CIDRs. Thus, we need to block admins from using this API (while not interfering with kube-apiserver's own use of the API).