bridge: refactor local packet handling

[ivy]

Summary

Remove the GRAB_OUR_PACKETS() macro and sprinkle its remains over
bridge_input():

• check much earlier if we should punt the packet to vlan(4), or if it's filtered by pfil, or if we need to learn the address.

• actual local packet handling is moved to a new function, bridge_try_local().

While here, change handling of frames received from discarding (STP)
ports to drop the frames instead of passing them to the host IP stack.

[ivy]

no need to call bridge_rtupdate() in bridge_forward() now

[ivy]

improve code a little; add more comments; ensure the bif is set correctly for netmap-injected frames

[ivy]

change the order of input processing: do filtering, then monitoring, then span,
so monitor and span see the same frames and don't see filtered frames.

improve some comments.

fix the member_ifaddrs_enabled test (the bridge needs to be up to pass frames now).