If we have namespaces Source and Destination, and Destination
contains a NetworkPolicy allowing access from Source, we need
to provision the ipsets for Source and add them to relevant
selectors, even though Source is DefaultAllow.
This also fixes an issue where if the Namespace labels are updated,
that would be ignored.
Fixes#3059
This behaviour was breaking the use of pod selectors for the 'from'
part of a rule.
Move checking of local pods into namespace.go so we can maintain
LocalIpSet correctly
Mike Bryant