if_bridge: add group_fwd_mask ioctl for reserved link-local multicast

[namkhanh052005_gmail.com]

Summary

Adds a group_fwd_mask control to if_bridge(4) (new BRDGGFWDMASK/
BRDGSFWDMASK ioctls, exposed as ifconfig bridge0 group_fwd_mask
<mask>), modeled after the Linux bridge control of the same name. The
mask selects which of the reserved link-local multicast MAC destinations
(01:80:C2:00:00:0x) the bridge forwards rather than filters. The
default is unchanged and conservative: no reserved groups are forwarded
unless an operator opts in.

This is the smallest change in the series and touches only the bridge's
ioctl control surface. The multicast snooping work follows in D2-D8.

Test Plan

group_fwd_mask ATF test covers get/set and bounds checking. Manual VNET
test confirms selected link-local traffic is forwarded only when the mask
is explicitly widened, and filtered by default. Kernel built and booted on
both stable/14 and current main (2026-08-07); ATF passes on both.