bnxt: Report SR-IOV VF status

[kbowling]

Summary

Expose the effective per-VF MAC and policy state through the iflib VF
status method.  Snapshot the state under the SR-IOV lock so concurrent
trust and anti-spoof sysctl updates cannot produce a torn report.

Record completion of the per-VF configuration callback separately from
firmware resource allocation.

Test Plan

I don't have HW, can you route to the right Broadcom folks?

[kbowling]

This is a basic implementation, someone more familiar with the driver may look at the nvlist schema and https://reviews.freebsd.org/D58739 which demonstrates driver extensions.