This changes the --legacy-userspace-proxy flag to be a string flag
--proxy-mode.  If specified, the flag will be respected ('userspace' and
'iptables' being valid values).  If left blank (default) we will choose the
"best".  best means userspace for now UNLESS the user adds an annotation
(net.experimental.kubernetes.io/proxy-mode) to their node, in which case we
will try to use that.

This allows people to try it on a single machine without fear of global failure
and without it getting rolled back on reboots.  It is a poor-man's config blob.