Move calico-policy-controller into separate role

By default Calico CNI does not create any network access policies
or profiles if 'policy' is enabled in CNI config. And without any
policies/profiles network access to/from PODs is blocked.

K8s related policies are created by calico-policy-controller in
such case. So we need to start it as soon as possible, before any
real workloads.

This patch also fixes kube-api port in calico-policy-controller
yaml template.

Closes #1132

roles/kubernetes-apps/meta/main.yml

@@ -1,9 +1,4 @@
 dependencies:
-  - role: download
-    file: "{{ downloads.calico_policy }}"
-    when: ( enable_network_policy is defined and enable_network_policy == True ) or
-      ( kube_network_plugin == 'canal' )
-    tags: [download, network, canal]
   - role: download
     file: "{{ downloads.netcheck_server }}"
     when: deploy_netchecker