Move NodeBalancer firewall validation from creation time to preflight check

[ChihweiLHBird]

What this PR does / why we need it:

Moves firewall existence validation for direct NodeBalancerFirewallID from EnsureNodeBalancer to the controller's preflight checks, matching the existing behavior for NodeBalancerFirewallRef. This provides earlier feedback when a non-existent firewall ID is specified. Splits reconcilePreflightLinodeFirewallCheck into reconcilePreflightFirewallID and reconcilePreflightFirewallRef.

Special notes for your reviewer:

TODOs:

• squashed commits
• includes documentation
• adds unit tests
• adds or updates e2e tests

[Copilot]

Pull request overview

Moves NodeBalancer firewall existence validation for direct NodeBalancerFirewallID from the load balancer service layer into the LinodeCluster controller preflight checks, aligning it with the existing NodeBalancerFirewallRef preflight behavior for earlier feedback during reconciliation.

Changes:

• Split the controller preflight firewall check into reconcilePreflightFirewallID and reconcilePreflightFirewallRef, and invoke the appropriate one based on spec configuration.
• Remove direct-firewall GetFirewall validation from cloud/services.EnsureNodeBalancer, passing the ID through to the Linode API create call.
• Update unit tests: add controller coverage for “direct firewall ID not found” and remove service-level coverage that no longer applies.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
internal/controller/linodecluster_controller.go	Adds preflight validation for direct firewall IDs and splits preflight logic into ID vs Ref paths.
internal/controller/linodecluster_controller_test.go	Adds a controller test path asserting the preflight condition is set false when a direct firewall ID is invalid.
cloud/services/loadbalancers.go	Removes firewall existence validation from EnsureNodeBalancer when a direct ID is provided.
cloud/services/loadbalancers_test.go	Removes expectations/tests tied to the deleted service-layer GetFirewall validation.