ice: Fail closed when VF reset does not complete

[kbowling]

Summary

ice_reset_vf() logs failures to drain PCIe transactions, issue the
mandatory zero-queue command, or observe VFR completion, but still
publishes VFACTIVE.  A VF can resume against reset state which the PF
knows is incomplete.

Return an error from the reset operation and retain a reset-failed flag
when any mandatory stage fails.  Reject ordinary virtchnl requests while
the failure persists.  Publish VFACTIVE only after every stage succeeds.
A later VFLR or PF rebuild can recover the VF and clear the failure.

Remove tracked queue leaves before clearing their software state.  The
reset-only AdminQ command drains hardware queues but does not update the
shared scheduler database; losing that bookkeeping can strand queue
resources across VF teardown and recreation.

After a successful VF reset, discard software switch-filter state whose
hardware rules were reset and clear guest-owned MAC and VLAN tracking.
Restore PF-owned anti-spoof policy, the broadcast filter, and the
assigned MAC before publishing VFACTIVE.  The guest can then replay its
own filter state without stale software entries suppressing the firmware
requests.
This follows the ownership split in the Linux ICE single-VF reset path.

Tested on an E810-XXV with a host-attached iavf.  Repeated VFLRs rebuilt
the base filters with new firmware rule IDs and restored traffic.
Forced reset-stage and policy-replay failures remained inactive until
recovery, and a PF reset rebuilt the VF and restored live traffic
automatically.

This follows the conservative reset policy used by ixl(4).

MFC after:      2 weeks
Sponsored by:   BBOX.io