Support EgressIP role in shiftstack-qa automation

[dlaw4608]

Added EgressIP test role to shiftstack-qa

Migrate EgressIP testing from Jenkins/infrared to shiftstack-qa as part of
the effort to consolidate all OpenShift-on-OpenStack testing into a single
framework.

This PR adds a new egressip_tests stage role that:

• Clones and builds openshift-tests-private test suite
• Dynamically detects OCP version and network backend (OVNKubernetes/OpenShiftSDN/Kuryr)
• Filters tests using per-version, per-backend allowlists
• Runs filtered EgressIP test suite against the cluster
• Collects JUnit results and triggers must-gather on failures

The allowlist structure (ported from rhos-infrared/egressip-whitelist.yaml)
supports OCP 4.12-4.22 with version and network backend specific test filtering.
Tests are filtered from thousands down to ~14-20 relevant EgressIP tests based
on the cluster configuration.

Integration:

• Added egressip_tests to osp_verification.yaml for OSP candidate release testing
• Integrated into main testing pipeline (ocp_testing.yaml)
• Follows existing shiftstack-qa patterns (prepare → run → post → cleanup)

Generated with the help of Claude Code sonnet 4.5

[imatza-rh]

Nice work porting the EgressIP tests. A few items to address before CI:

1. Private repo clone will fail
The shared prepare_openshift_tests.yml clones via unauthenticated HTTPS. openshift-tests-private is a private repo and will 404. The IR plugin handles this with SSH + deploy key for private repos. We need a similar mechanism in our shared role.

Since shiftstack-qa is a public repo, the deploy key can't be committed as plaintext like the IR plugin does. It should go into configs/secret.yaml (vault-encrypted) or be injected via CI secrets.

2. Build command
make WHAT=cmd/openshift-tests (run_egressip_tests.yml:42) is the origin repo pattern. openshift-tests-private's Makefile doesn't use WHAT - it works because the variable is ignored and the default target runs, but the correct command is make build (matching the IR plugin).

3. Needs end-to-end verification
Before merging, this should be executed against a live environment to confirm the full flow works: clone, build, test filtering, execution, and result collection. Have you been able to run this successfully?

Everything else looks good - the allowlist covers the same test set as the IR source (with simplified regexes), the version/backend detection logic is solid, and skipping the copy step matches the IR plugin's approach for this repo.