ice: Enforce VF MAC anti-spoof policy

[kbowling]

Summary

The SR-IOV schema enables MAC anti-spoofing by default and reports
it through VF status, but the driver never programs the VSI security
section.  A VF can therefore transmit with an arbitrary source address
despite the advertised policy.

Program ICE_AQ_VSI_SEC_FLAG_ENA_MAC_ANTI_SPOOF when the VF VSI is
created, and replay the policy when the VSI is rebuilt after a PF or
device reset.  Fail VF creation or rebuild when firmware cannot install
the security policy so an unprotected VF is never published as active.

Validated on E810 hardware with host-attached and Linux passthrough
VFs.  Traffic using the assigned source MAC passed while otherwise
identical forged-source frames were dropped.  After a PF reset, assigned
traffic resumed and zero of ten forged frames reached the peer.

An injected MAC anti-spoof update failure left the VF inactive with
PCI bus mastering disabled.  Destroying and recreating the SR-IOV
configuration restored the policy and traffic.

MFC after:      2 weeks
Sponsored by:   BBOX.io