Align RX steering with the kernel RSS framework and factor out the
active-traffic-class count.

RSS key and indirection table: on an options RSS kernel the stack owns a
canonical hash key and a hash-to-bucket indirection table binding each
bucket to a CPU. aq programmed a random arc4rand() key and a plain
i % rss_qs table, so the hash it stamped in iri_flowid and the queue it
steered a flow to did not match the CPU the stack chose -- defeating RSS
affinity. Under #ifdef RSS take the key from rss_getkey() and each entry
from rss_get_indirection_to_bucket(), as e1000/ixgbe/ixl do; the non-RSS
build keeps the random key and round-robin table.

RSS hash-type policy: drop the private hw.aq.enable_rss_udp knob (RDTUN,
default on) and add aq_rss_hashconfig(), which under options RSS returns
rss_gethashconfig() and otherwise the same UDP-off default. UDP 4-tuple
hashing scatters a fragmented datagram's pieces across queues because
only the first fragment carries the L4 ports, so it is now off by default
and re-enabled the standard way, via net.inet.rss.udp_4tuple, matching
ix/ixl/mlx5. On Atlantic 1 the UDP-off action stays the existing L3L4
flow-filter workaround; only its policy source changes.

TX traffic-class helper: factor the active-TC count (one per active
8-ring group, capped at HW_ATL_B0_TCS_MAX) out of aq_hw_qos_set() into
aq_hw_active_tcs(), so there is a single definition of the policy; the
Atlantic 2 RSS redirection table reuses it.