allocator: crd: jitter identity creation

This adds some jitter to the allocator backoff, as well as waiting a random time before first allocation. This aims to reduce collisions where a duplicate identity is created for the same set of labels.

This is only enabled for the CRD allocator, as it can collide when allocating the same identity. The kvstore allocator does not suffer this problem.

This works in concert with #38031, which can delay re-allocations for up to 30 seconds. That option protects against overload when a large namespace is re-labeled. This is smaller in scope, with less delay, intended only to reduce duplicates.

Delays CiliumIdentity allocation for a short random period of time, which can help reduce duplicate identity creation.