ice: Make VF MAC filter requests idempotent

[kbowling]

Summary

VF drivers replay their address filters after reset and may retry a
request whose reply was lost.  The PF tracked only a count and
incremented it after an idempotent hardware add, so duplicate replays
eventually exhausted the quota.  It then rejected an entire address
batch, including the administrator-assigned address.

Track exact non-primary MAC filter membership within each VF quota.
Validate a complete batch before changing hardware, charge only unique
absent addresses, and update ownership after each successful operation.
Preserve an administrator-assigned address when the VF is not permitted
to change it.

Validated on an E810-XXV with a host-attached iavf VF.  The configured
filter quota was filled, then the complete set was replayed across VFR
and PF reset without a duplicate warning or ADD_ETH_ADDR NACK.  Deleting
an absent address was a no-op.  With allow-set-mac disabled, the guest
could not remove its administrator-assigned filter, while multicast
filter additions continued to succeed.

MFC after:      2 weeks
Sponsored by:   BBOX.io