Change kube-proxy flag: annotation for proxy-mode

This changes the --legacy-userspace-proxy flag to be a string flag
--proxy-mode.  If specified, the flag will be respected ('userspace' and
'iptables' being valid values).  If left blank (default) we will choose the
"best".  best means userspace for now UNLESS the user adds an annotation
(net.experimental.kubernetes.io/proxy-mode) to their node, in which case we
will try to use that.

This allows people to try it on a single machine without fear of global failure
and without it getting rolled back on reboots.  It is a poor-man's config blob.

hack/verify-flags/known-flags.txt

@@ -143,7 +143,6 @@ kubelet-timeout
 kube-master
 label-columns
 last-release-pr
-legacy-userspace-proxy
 limit-bytes
 load-balancer-ip
 log-flush-frequency
@@ -210,6 +209,7 @@ private-mountns
 prom-push-gateway
 proxy-bindall
 proxy-logv
+proxy-mode
 proxy-port-range
 public-address-override
 pvclaimbinder-sync-period