integration: add CI-scaled timeouts and curl helpers for flaky ACL tests

Add ScaledTimeout to scale EventuallyWithT timeouts by 2x on CI,
consistent with the existing PeerSyncTimeout (60s/120s) and
dockertestMaxWait (300s/600s) conventions.

Add assertCurlSuccessWithCollect and assertCurlFailWithCollect helpers
following the existing *WithCollect naming convention.
assertCurlFailWithCollect uses CurlFailFast internally for aggressive
timeouts, avoiding wasted retries when expecting blocked connections.

Apply these to the three flakiest ACL tests:

- TestACLTagPropagation: swap NetMap and curl verification order so
  the fast NetMap check (confirms MapResponse arrived) runs before
  the slower curl check. Use curl helpers and scaled timeouts.

- TestACLTagPropagationPortSpecific: use curl helpers and scaled
  timeouts.

- TestACLHostsInNetMapTable: scale the 10s EventuallyWithT timeout.

Updates #3125

integration/integrationutil/util.go

@@ -37,6 +37,18 @@ func PeerSyncRetryInterval() time.Duration {
 	return 100 * time.Millisecond
 }
 
+// ScaledTimeout returns the given timeout, scaled for CI environments
+// where resource contention causes slower state propagation.
+// Uses a 2x multiplier, consistent with PeerSyncTimeout (60s/120s)
+// and dockertestMaxWait (300s/600s).
+func ScaledTimeout(d time.Duration) time.Duration {
+	if util.IsCI() {
+		return d * 2
+	}
+
+	return d
+}
+
 func WriteFileToContainer(
 	pool *dockertest.Pool,
 	container *dockertest.Resource,