gce: configure public SSH rules when using bastions

[upodroid]

Related to #17680

We are using private topology with scale jobs and the control plane instances configured public IP addresses so we cann SSH to the instances. However, we are not applying the public inbound SSH rule because if a bastion is enabled, it assumes you will always connect to the instances using the bastion which is false in clusterloader2 and ssh-external-to-master rules are missing.

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign hakman for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[upodroid]

/cc @hakman

[justinsb]

So we are creating tasks with the same name in two places, which is normally a sign that we can tweak the if statement to avoid duplication.

But ... I think the same comment as the other PR. This looks like it affects everyone, not just the scalability test. Can we introduce it behind a feature flag or simialr?

[upodroid]

I changed the logic to remove the duplication of rules.

It's fair to assume:

1. Spec.SSHAccess has a value and reaching the masters/nodes from that address isn't an issue
2. If you are using a bastion and the instances don't have a public IP, the rule sits there doing nothing