remoteCidr generated policy should only include except if in the range

[mjnagel]

https://github.com/defenseunicorns/uds-core/blob/2f63db2f26cb30c056f376b1823f758cd403aefe/src/pepr/operator/controllers/network/generators/remoteCidr.ts

Our current remoteCidr policies will unconditionally add the except block with the cloud metadata IP. We should either:

1. Conditional add it: based on whether it is included in the cidr we put in the policy, this would require determining if the CIDR includes it.
2. Never include it: Just drop that entirely, simpler but would allow someone to set this to 0.0.0.0/0 or another similar range that includes metadata.

Historically I have encountered issues when except IPs/CIDRs are not contained in the range. I haven't identified any upstream docs or issues related to this but could search for those if required.