Validate Preferred Group shared-service providers (#244)

[jeestr4d]

Fixes #244.

Summary

Adds a pre-upgrade validation for Preferred Group members that provide tenant-
or global-scope shared-service contracts.

The check:

• Runs for ACI target releases 4.2 and later.
• Selects fvAEPg and l3extInstP providers with
  prefGrMemb="include" and shared/global pcTags 17-16385.
• Requires a materialized provider-side vzFromEPg to vzToEPg
  relationship; provider configuration alone is not reported.
• Resolves provider context through
  vzFromEPg.scopeId -> fvCtxDef.scope -> fvCtxDef.dn.
• Compares the provider context DN with vzToEPg.ctxDefDn and reports only
  cross-context relationships.
• Requires matching tenant ancestry for tenant-scope contracts.
• Reports the specific affected consumer DN and de-duplicates result rows.

Version behavior

Target version	Behavior
Before 4.2	Check is not applicable
4.2 through target releases before 6.0(1g)	Report any materialized cross-context consumer class; early releases can have silent forwarding risk, while later 4.2/5.x releases can reject the configuration with F0467
6.0(1g) and later	Report only cross-context L3Out (/instP-) or vzAny (/any) consumers; ordinary EPG-to-EPG shared service is allowed
6.1(3f) and later	Same restricted topology; product validation may surface the condition through F4684

The source-proven Preferred Group-specific F0467 boundaries are 4.2(6d),
5.1(3e), and first-proven 5.2(1g). The first source-visible narrowed behavior
is 6.0(1g).

Sanitized integration result

The deterministic ACI 5.2(4d) to 5.2(8f) integration job identified seven
materialized cross-context relationships across three fabrics:

Fabric	Findings
Fabric A	2
Fabric B	4
Fabric C	1

Sanitized examples:

Shared-service contract	Preferred Group provider	pcTag	Affected consumer
uni/tn-Tenant-A/brc-Shared-Contract-1	uni/tn-Tenant-A/ap-App-Provider/epg-Provider-1	57	uni/tn-Tenant-B/ap-App-Consumer/epg-Consumer-1
uni/tn-Tenant-C/brc-Shared-Contract-2	uni/tn-Tenant-C/ap-App-Provider/epg-Provider-2	10934	uni/tn-Tenant-D/ap-App-Consumer/epg-Consumer-2
uni/tn-common/brc-Shared-Contract-3	uni/tn-Tenant-E/ap-App-Provider/epg-Provider-3	10932	uni/tn-Tenant-F/ap-App-Consumer/epg-Consumer-3

Every reported row has a concrete materialized consumer instead of the prior
provider-only Any value.

One additional integration fabric returned APIC DME 503 Resolve timeout
responses. Multiple unrelated validations timed out concurrently on that
fabric. In most affected runs, this check timed out on its first vzBrCP
query and never reached the new fvCtxDef or vzFromEPg queries.

Validation

• Focused Preferred Group tests: 35 passed.
• Full local suite: 1,050 passed.
• GitLab Python 2.7 unit job: passed.
• GitLab Python 3.8 unit job: passed.
• GitLab integration pipeline exercised the updated logic against live
  fabrics.

[monrog2]

integration test has no issues related to this check

[monrog2]

1. Only checking global scope contract, also tenant scope can be denote shared services.
2. what about vzAny scenario?

[monrog2]

Requesting changes because the new validation can skip affected upgrade targets, fail on valid APIC responses, and report outage warnings for configurations outside the documented defect condition. The test layout follows the repository convention, but it needs regression coverage for these cases and should validate the returned details, not only the status. Focused Python 3.8 tests pass (10/10), but the version-gating and missing-children defects were independently reproduced.