How to use CiliumCIDRGroup on AKS to model external Azure endpoints as reusable, labeled policy targets for cleaner Cilium network policies.