Problem:

1. egress firewall affects node ips, but always allows management port ip, which gives access to the node.
2. performance: every egress firewall acl is created with a separate transaction (fixed in https://issues.redhat.com/browse/OCPBUGS-17970)
3. performance: using source port group instead of address set will decrease the number of ovs flows per node (tracked under https://issues.redhat.com/browse/SDN-4173)
4. performance: we use `dst != clusterSubnet` exclusion that may result in many ovs flows (fixed in https://github.com/ovn-org/ovn-kubernetes/pull/3338, )
5. dns address sets are not cleaned up on restart