[multicast] Bitmap-based multicast replication for sidecar-lite

[zeeshanlakhani]

This adds multicast replication to sidecar-lite, emulating DPD's sidecar.p4 on dendrite @ zl/mcast-swadm, following RFD 488.

We manage 2 bitmaps per underlay group (external and underlay), for which replication is driven by p4rs replicate (dep @ p4#240). Ingress zeroes out at most one of these bitmaps determined by the geneve multicast option tag (tag 0 zeroes out underlay; tag 1 zeroes out external), and merges both.

Tag 0 (External) also decaps upon ingress. With no tag given, as on external NAT ingress packets, both bitmaps remain in place.

Only geneve-encapsulated multicast commits to replication. Multicast packets that miss ingress NAT drop on the empty bitmap, matching DPD's drop_mcastv{4,6}_no_group semantics. Packet copies that remain encapsulated lose a hop on the outer IPv6 header, as modelled in MulticastRouter6.

External multicast is NAT-encapsulated into the underlay via nat_v{4,6_mcast(_untagged), reusing forward_to_sled. Tagged and untagged variants exist as separate tables since x4c cannot key directly on header validity. The encap piece now zeroes out the outer src, traffic class, flow label, and inner eth src, like DPD's add_encap_headers.

Egress decap checks ff04::/64 and tag=2, matching DPD's egress mcast_tag_check, with per-port decap from a RID-keyed bitmap (tbl_decap_ports) and optional VLAN. tag=2 decapsulation also rejects inner unicast. tag=0 copies (already decapped in ingress) use the table for the VLAN. Dst MAC derivation (RFC 1112, RFC 2464) and per-port src MAC rewriting run on every packet copy.

Includes:

• The parser rejects ff01 addresses outright, as well as ff02 destined packets with a hop limit of 0 (ff02 does still go to the scrimlet).
• Multicast packets with a TTL/hop_limit <= 1 get dropped in ingress after the fwd_from_scrimlet return, letting scrimlet transmissions pass through.
• Both decapsulation paths drop inner TTL <= 1. IPv4 checksums use RFC 1624 (eqn. 3): a checksum of 0xfeff turns into 0x0000 after decrementing the TTL (XOR used here due to ~ not being parsable by x4c).
• scadm gets add/remove/dump for replication (v6), source filters, mcast NAT, decap ports, src MAC, and asic-id-to-port (for logical mapping).
• Unicast modifications:
  • The router drops TTL/hop_limit <= 1 and decrements remaining packets on routes to nonzero ports, updating the IPv4 checksum.
    • Port 0 (the scrimlet) skips both the TTL check and decrement.
    • DPD's Router4/6 still decrement service-bound packets.
  • The NAT encap zeroing described above is shared with unicast NAT.
  • Packets with a parsed Geneve header skip ingress NAT, including unicast.

References

This work depends on the P4(rs) work in #240 and softnpu's zl/multicast.