Calico upgrade path validation and old version cleanup (#6733)

* calico: add constant calico_min_version_required

and verify current deployed version against it.

* calico: remove upgrade support with data migration

The tool was used pre v3.0.0 and is no longer needed.

* calico: remove old version support from tasks

* calico: remove old ver support from policy ctrl

* calico: remove old ver support from node

* canal: remove old ver support

* remove unused calicoctl download checksums

calico_min_version_required is the oldest version that can be installed
Older versions can be removed.

roles/network_plugin/canal/templates/canal-node.yaml.j2

@@ -53,7 +53,6 @@ spec:
           hostPath:
             path: /run/xtables.lock
             type: FileOrCreate
-{% if calico_version is version('v3.4.0', '>=') %}
       initContainers:
         # This container installs the Calico CNI binaries
         # and CNI network config file on each node.
@@ -78,28 +77,7 @@ spec:
               name: cni-net-dir
             - mountPath: /host/opt/cni/bin
               name: cni-bin-dir
-{% endif %}
       containers:
-{% if calico_version is version('v3.3.0', '>=') and calico_version is version('v3.4.0', '<') %}
-        - name: install-cni
-          image: {{ calico_cni_image_repo }}:{{ calico_cni_image_tag }}
-          command: ["/opt/cni/bin/install"]
-          env:
-            # Name of the CNI config file to create.
-            - name: CNI_CONF_NAME
-              value: "10-canal.conflist"
-            # Install CNI binaries
-            - name: UPDATE_CNI_BINARIES
-              value: "true"
-            # The CNI network config to install on each node.
-            - name: CNI_NETWORK_CONFIG_FILE
-              value: "/host/etc/cni/net.d/canal.conflist.template"
-          volumeMounts:
-            - mountPath: /host/etc/cni/net.d
-              name: cni-net-dir
-            - mountPath: /host/opt/cni/bin
-              name: cni-bin-dir
-{% endif %}
         # Runs the flannel daemon to enable vxlan networking between
         # container hosts.
         - name: flannel
@@ -215,12 +193,6 @@ spec:
                   fieldPath: spec.nodeName
             - name: FELIX_HEALTHENABLED
               value: "true"
-            # Prior to v3.2.1 iptables didn't acquire the lock, so Calico's own implementation of the lock should be used,
-            # this is not required in later versions https://github.com/projectcalico/calico/issues/2179
-{% if calico_version is version('v3.2.1', '<') %}
-            - name: FELIX_IPTABLESLOCKTIMEOUTSECS
-              value: "10"
-{% endif %}
             # Disable IPv6 on Kubernetes.
             - name: FELIX_IPV6SUPPORT
               value: "false"
@@ -255,17 +227,10 @@ spec:
             initialDelaySeconds: 5
             failureThreshold: 6
           readinessProbe:
-{% if calico_version is version('v3.3.0', '<')%}
-            httpGet:
-              host: 127.0.0.1
-              path: /readiness
-              port: 9099
-{% else %}
             exec:
               command:
               - /bin/calico-node
               - -felix-ready
-{% endif %}
             periodSeconds: 10
           volumeMounts:
             - mountPath: /lib/modules