Add support for plugin ordering

[rainest]

What this PR does / why we need it:
Adds plugin ordering support. Uses unreleased KTF, deck, and go-kong for now. Adds integration tests against nightly Kong images. Requesting review in advance of dependencies since I want to avoid multiple upstream releases in case change requests affect stuff in libraries.

Depends on Kong/go-kong#187, Kong/deck#710, and Kong/kubernetes-testing-framework#314

Fix #2656

Special notes for your reviewer:

PR Readiness Checklist:

Complete these before marking the PR as ready to review:

• the CHANGELOG.md release notes have been updated to reflect any significant (and particularly user-facing) changes introduced by this PR

[shaneutt]

Looks solid to me, even though it says draft. I would just like to see us use the new cleanup method for the integration tests and then LGTM.

[rainest]

Kong nightly failure on the TLSRoute example is on the Kong side. It cannot find the workspace ID of the certificate.

The upstream bug that corrects this is fixed, but at some point the Kong nightly repo stopped updating latest (or rather, it's derived from the wrong branch), and the image it was pulling was ~2m old. Newer releases are available, but you need to know the specific tag for the commit you want. This won't be fixed in the immediate future, so for now I'll just remove the OSS nightly--the Enterprise one should suffice for most purposes.

2022/07/11 17:33:25 [error] 1149#0: *9252 stream [lua] certificate.lua:33: log(): [ssl] failed to get from node cache: callback threw an error: /usr/local/share/lua/5.1/kong/db/strategies/off/init.lua:233: attempt to concatenate local 'ws_id' (a nil value)
stack traceback:
	/usr/local/share/lua/5.1/kong/db/strategies/off/init.lua:233: in function 'select'
10.244.0.1 [11/Jul/2022:17:33:25 +0000] TCP 500 0 0 0.000
	/usr/local/share/lua/5.1/kong/db/dao/init.lua:987: in function 'select'
	/usr/local/share/lua/5.1/kong/runloop/certificate.lua:134: in function </usr/local/share/lua/5.1/kong/runloop/certificate.lua:133>
	[C]: in function 'xpcall'
	/usr/local/share/lua/5.1/resty/mlcache.lua:741: in function 'get'
	/usr/local/share/lua/5.1/kong/cache/init.lua:168: in function 'find_certificate'
	/usr/local/share/lua/5.1/kong/runloop/certificate.lua:249: in function 'execute'
	/usr/local/share/lua/5.1/kong/runloop/handler.lua:1197: in function 'before'
	/usr/local/share/lua/5.1/kong/init.lua:763: in function 'ssl_certificate'
	ssl_certificate_by_lua:2: in main chunk, context: ssl_certificate_by_lua*, client: 10.244.0.1, server: unix:/kong_prefix/stream_tls_terminate.sock

Don't think the resource matters since DB-less should always be the default WS, but whatever:

10:33:25-0700 esenin $ http 192.168.16.242:8001/certificates                                          
HTTP/1.1 200 OK
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Length: 1613
Content-Type: application/json; charset=utf-8
Date: Mon, 11 Jul 2022 17:54:56 GMT
Server: kong/2.8.0-fe20857b0
X-Kong-Admin-Latency: 0

{
    "data": [
        {
            "cert": "-----BEGIN CERTIFICATE-----\nMIIC/jCCAoSgAwIBAgIUVL6UYVDdH6peVNSOnOkCuYyhmrswCgYIKoZIzj0EAwIw\ngbQxCzAJBgNVBAYTAlVTMRMwEQYDVQQIDApDYWxpZm9ybmlhMRYwFAYDVQQHDA1T\nYW4gRnJhbmNpc2NvMRMwEQYDVQQKDApLb25nLCBJbmMuMRgwFgYDVQQLDA9UZWFt\nIEt1YmVybmV0ZXMxHjAcBgNVBAMMFXRsc3JvdXRlLmtvbmcuZXhhbXBsZTEpMCcG\nCSqGSIb3DQEJARYadGVzdEB0bHNyb3V0ZS5rb25nLmV4YW1wbGUwIBcNMjIwNjE2\nMjExMjI4WhgPMjEyMjA1MjMyMTEyMjhaMIG0MQswCQYDVQQGEwJVUzETMBEGA1UE\nCAwKQ2FsaWZvcm5pYTEWMBQGA1UEBwwNU2FuIEZyYW5jaXNjbzETMBEGA1UECgwK\nS29uZywgSW5jLjEYMBYGA1UECwwPVGVhbSBLdWJlcm5ldGVzMR4wHAYDVQQDDBV0\nbHNyb3V0ZS5rb25nLmV4YW1wbGUxKTAnBgkqhkiG9w0BCQEWGnRlc3RAdGxzcm91\ndGUua29uZy5leGFtcGxlMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEQecfzsxmPwC0\n6uNs3kyiLDb6brngM4ZtGXgwcGD393cbYmaunfBPRtxqh76RKdS9wzq4q+oB8dPs\nQKgBNhlJTr+iFH9Di7bBZFcYqx+SnNUXZ0dDNBbW4rPVTJHQvdono1MwUTAdBgNV\nHQ4EFgQU+OOVbqMcu+yXomZfnZ54LgIRNo4wHwYDVR0jBBgwFoAU+OOVbqMcu+yX\nomZfnZ54LgIRNo4wDwYDVR0TAQH/BAUwAwEB/zAKBggqhkjOPQQDAgNoADBlAjBu\nPMq+T+iTJ0yNvldYpB3BfdIhrv0EJQ9ALbB16nJwF91YV6YE7mdNP5rNVnoZ0nAC\nMQDmnIpipMawjJWpfSPSZS1/iArz8YuBroWrGFXP62lwhCUp8RZweNnrLmmb/Aek\ny3o=\n-----END CERTIFICATE-----",
            "cert_alt": null,
            "created_at": 1657560260,
            "id": "6e38f366-5589-4606-84b9-6b4f53be2b92",
            "key": "-----BEGIN PRIVATE KEY-----\nMIG2AgEAMBAGByqGSM49AgEGBSuBBAAiBIGeMIGbAgEBBDDDRndgPYZaonVuqHiu\n5uuYWI+A16BYLoUBnY0/9BL9U0s47G7LC/b05wE/7UPJEBKhZANiAARB5x/OzGY/\nALTq42zeTKIsNvpuueAzhm0ZeDBwYPf3dxtiZq6d8E9G3GqHvpEp1L3DOrir6gHx\n0+xAqAE2GUlOv6IUf0OLtsFkVxirH5Kc1RdnR0M0Ftbis9VMkdC92ic=\n-----END PRIVATE KEY-----",
            "key_alt": null,
            "snis": [
                "tlsroute.kong.example"
            ],
            "tags": null
        }
    ],
    "next": null
}

[shaneutt]

? New PR coming?