Fold the thermal-protection work and the correctness fixes that landed
alongside it.

Report and auto-recover from PHY thermal shutdown. The Atlantic PHYs can
autonomously shut down on over-temperature, latching global fault 0x8007
and dropping the link; Atlantic 2 ships this armed, Atlantic 1 disabled.
Arm it on Atlantic 1 at interface init (1E.C478.A via the MAC's MDIO
controller), and recover from a trip automatically: the admin-status poll
detects the fault, logs the shutdown limit and measured temperature, and
holds the link down until the PHY cools, then restores it -- Atlantic 1
needs a PHY reset (1E.2681.0) with the MAC firmware running plus a full
re-init, Atlantic 2 recovers on the re-init alone. New firmware ops
get_phy_fault, phy_reset, thermal_arm, and get_thermal_limit back the
state machine in aq_if_update_admin_status().

Make that Atlantic 1 thermal MDIO path address-correct and fail-safe.
The direct-MDIO helpers hardcoded the Clause-45 port address to 0, but it
is strap-selectable: on a board whose PHY answers elsewhere every thermal
op targeted nothing, so arming silently no-oped and the post-trip reset
never cleared the latch. Discover the address by scanning ports 0..31
for a PMA/PMD identifier and form it as (phy_id << 5) | mmd, marking it
valid only when a PHY actually answers. aq_fw2x_phy_read also returned 0
on a semaphore timeout, indistinguishable from a real 1E.C478 == 0, so
thermal_arm could zero live provisioning bits; give the read an error
return and gate thermal_arm and get_thermal_limit on it.

Bound the multicast filter slot index. aq_mc_filter_apply() programmed
slot count + 1 and bailed only at count == AQ_HW_MAC_MAX (33), one
address too late, so a 33rd entry raced in between the if_llmaddr_count()
snapshot and the if_foreach_llmaddr() walk drove an out-of-bounds MMIO
write to slot 33. Fire the guard at AQ_HW_MAC_MAX - 1, and also reject
index >= AQ_HW_MAC_MAX in aq_hw_mac_addr_set() where the slot becomes an
RPF register offset.

Correctness and safety fixes: initialize the sysctl context in
attach_pre so the iflib fail-path detach cannot sysctl_ctx_free() an
uninitialized list (a page fault when MSI/MSI-X is denied); range-check
the Atlantic 2 action-resolver table index, taken verbatim from a
firmware-supplied base, before writing the ART registers; and accumulate
statistics deltas as unsigned, since AQ_SDELTA discarded a forward delta
of 2^31 or more at 10G across a stretched admin poll.

Signed-off-by: Nick Price <nick@spun.io>