CKS on VPC: deleting a cluster removes ACL rules used by other clusters #14409

problem

When a CKS cluster deployed on a VPC tier is deleted, CKS revokes all TCP
allow rules for ports 6443 and 22 in the tier's network ACL list, not only
the rules it created for that cluster. Other clusters using tiers with the
same ACL list lose their rules.

Impact

• SSH port forwards (2222+ → 22) to cluster B's nodes are blocked by the
  ACL, so operations that SSH to the nodes (e.g. scaling) fail unless
  another rule allows TCP 22.
• On a conserve-mode tier the API (6443) stays reachable, because it is
  behind the VPC router load balancer, which the tier ACL does not filter.
• On a non-conserve tier the API is a port forward, so it would also become
  unreachable.
• Stopping and starting cluster B does not recreate the missing rules, so
  the cluster cannot recover without manual ACL changes.

versions

4.23 with KVM

The steps to reproduce the bug

1. Create a VPC with a custom ACL list and assign it to two tiers.
2. Deploy a CKS cluster on each tier (cluster A and cluster B).
3. Note the ACL list contains a 6443 and a 22 allow rule for each cluster.
4. Delete cluster A.

Expected

Only cluster A's ACL rules are removed.

Actual

All CKS-created 6443 and 22 allow rules are removed, including cluster B's.
A manually created TCP 22 rule (created via the UI) was not removed.
Cluster B's public IP, port forwards and load balancer rule are unaffected.

What to do about it?

• Should CKS track the ACL rules it creates per cluster (e.g. in cluster
  details) and only remove those, or check whether other clusters still
  need a rule before removing it?
• Should starting a stopped cluster verify and recreate missing network
  rules?