ice: Isolate VFs after malicious-driver detection

[kbowling]

Summary

Consume the per-function MDD latches to attribute transmit and receive
events to the offending VF.  Treat the global debug registers only as
the last-cause diagnostic, add the missing Tx data-protection cause, and
select the E830 TCLAN register addresses when required.

Block every virtchnl request from an offending VF, reset it, and leave
its queues and interrupt mappings unconfigured.  Most MDD classes stop a
queue, but Tx data protection only drops the offending packet; the reset
makes the reported blocked state an actual DMA fence for every class.
Complete VFR without restoring resources so a later physical FLR can
create a new reset edge and recover the function.

Complete VFR before restoring queue and interrupt mappings.  E810 does
not retain mapping writes while VFSWR remains asserted; retaining the
original hardware order prevents an immediate post-attach VFR from
leaving queue-map enable clear.

E810 also sets a parent PF_MDET latch for an event attributed by a
VP_MDET latch to one of its VFs.  Do not reinitialize the PF for those
event classes.  This prevents a hostile VF from flapping PF and sibling
traffic while retaining recovery for an unattributed PF queue event.

Provide an opt-in auto-reset policy for operators who prefer
availability to persistent isolation.  Clear reset induced anti-spoof
latches before releasing a rebuilt VF, expose the blocked and traffic
state through the generic VF status interface, and report cumulative
per-VF Tx and Rx event counters in the ICE namespace.  Derive traffic
state from configured queues independently of the resource handshake;
iavf can resume from cached resources after a fast VFR.

This follows the MDD attribution and reset semantics in section
9.2.2.2.1 of the Intel E810 Datasheet.  The per-VF register coverage and
E830 TCLAN selection match the Intel ICE driver, while the default
fail-closed policy follows ixl(4).

Validated on E810 with four four-queue FreeBSD iavf VFs.  An invalid
tail write blocked only the offender, incremented its Tx MDD counter,
caused no PF reinitialization, and left a sibling at 50/50 successful
pings.  Physical FLR restored the offender and a PF reset rebuilt it
without a spurious anti-spoof block.  With auto-reset enabled, the
offender resumed after the reset while its sibling completed 60/60
pings; all queue-map enable bits remained set after the second VFR.

MFC after:      2 weeks
Sponsored by:   BBOX.io