Allowing ClusterIP when ExternalIPs slice has addresses

[filintod]

I had this PR a long time ago, but it did not progress and then the code base change quite a lot. So refactoring it back.

The idea is to let ClusterIP type services be allowed even if the ClusterIPSync flag is false when there are addresses in the ExternalIPs slice. This is used in some scenarios, or as in our case, when using kube-router instead of a loadbalancer.

[hashicorp-cla]

All committers have signed the CLA.