Make IPv6 opt-in and fix IPv6 correctness/robustness issues

Open

evidolobwants to merge intofrom

Summary

Builds on the IPv6 work from #59 and the fixes cherry-picked from karta0807913's ipv6 branch, making IPv6 support opt-in and addressing a set of correctness and robustness issues found while reviewing the IPv6 code paths.

Previously IPv6 was half-configured from individual fields (gatewayIPv6 / subnetIPv6): addresses, Router Advertisements, DHCPv6 and the IPv6 DNS listener were each enabled independently, so a partial config could leave a guest advertised an IPv6 prefix with no reachable gateway, DHCPv6 or DNS. IPv6 is now gated behind a single explicit EnableIPv6 switch and is either fully wired up or entirely absent.

Original PR: #59 ("WIP: IPv6 support" by @guillaumerose) — this branch is based on it
Cherry-pick source: https://github.com/karta0807913/gvisor-tap-vsock/tree/ipv6

Changes

Feature

feat(ipv6): make IPv6 support opt-in via EnableIPv6 — new config field, -enable-ipv6 flag, and GvproxyCommand plumbing; every IPv6 path is gated on it. Rejects IPv4 values for the v6 gateway/subnet, warns when the IPv6 flags are passed without -enable-ipv6, and derives the on-link prefix length from the subnet.

Fixes

fix(dns): answer default-IP zones by matching address family (A for IPv4, AAAA for IPv6, NODATA otherwise) instead of returning a bogus record.
fix(dhcpv6): skip the DNS option when the gateway IPv6 address is invalid rather than handing clients OptDNS(nil).
fix(forwarder): bound in-flight ICMP forwards with a semaphore and fix a packet refcount leak on the non-forwarded paths.
fix(tap): bounds-check IPv6 frames before parsing router solicitations to avoid panics on short/lying frames.
fix(ndp): compare parsed addresses when validating Neighbor Advertisement targets so a non-canonical GatewayIPv6 spelling is not wrongly dropped.
fix(ip_pool): do not hand out the IPv4 broadcast address.

Tests / CI

test(ipv6): gate the end-to-end IPv6 tests behind TEST_IPV6 (make test-qemu-ipv6 / make test-mac-ipv6), wire the qemu target into CI, and add external IPv6 connectivity specs.