Add OpenShift Local on a nested-virtualization GCE VM

The AWS single-node path needs a paid account. OpenShift Local runs the same OpenShift release on one GCE VM, so the SCC, arbitrary-UID and EgressFirewall cases have a home that costs one VM. Five commits:

• The VM and the cluster. just openshift-local doctor|up|status|oc|ssh|down. The router listens on every host interface, so up denies 80, 443 and 6443 to the instance before the VM exists; the kubeconfig and the kubeadmin password stay on the VM. Red Hat does not support CRC under nested virtualization, and the doc says so first.
• setup and start. virtiofsd is installed, start retries in place, and setup reinstalls CRC at another pinned release (SIM_CRC_VERSION on up), since each CRC release ships one OpenShift release and an Operator can lag it.
• Proven, with the Operator traps. A live run started the cluster on two CRC releases, installed the GitLab Runner Operator and completed a Duo flow on its runner. The doc names the three Operator behaviours that read as a broken rig.
• admit <simulation> [ports]. Allows tcp 443 and 5050 (or the ports named) from both of the VM's /32s to the simulation at priority 800, checks each port from the VM, and down deletes the rule. A rule naming only the internal address admitted nothing, because the simulation's URL is its external address.
• A quiet package install. dnf's progress goes to ~/dnf-install.log on the VM, printed only on failure.