[WiP] Update docs and manifests for adding iptables lock support to Felix

[fasaxc]

Description

Felix now supports (projectcalico/felix#1491) taking the iptables lock when doing iptables operations. This prevents it from conflicting with, for example, kube-proxy, which also takes the lock.

This PR:

• Updates the config docs to document the new config options introduced in Felix
• Modifies the manifests to mount in /run, which is where the iptables lockfile lives. Sadly, we can't map in a narrower directory or just the file because the file may not exist and, if it doesn't, docker maps in an empty directory instead.

Todos

• Test manifests
• Update Felix pin
• Documentation

Release Note

Felix now (optionally) acquires the iptables lock while manipulating iptables.  This prevents conflicts with other applications, such as kube-proxy (as long as they also honor the lock).  Upgrade note: to be effective if Felix is running in a container, this feature requires the directory containing the iptables lock file, `/run`, to be mounted into the container.  

[caseydavenport]

@fasaxc WDYT re: release notes for this guy? It should probably have one.

[fasaxc]

@caseydavenport Yeah, I'd done it on the felix PR. Moving it here.

[fasaxc]

Closing in favour of #935