Adds the net.link.bridge.igmp_snooping runtime enable knob, default off --
everything added in D2-D4 is inert until it is set -- and five counters:
mdb_entries, mdb_prune_hits, mdb_flood_fallback, mdb_parse_reject,
mdb_expired. Writing zero resets a counter. This makes learned state and
fallback behavior inspectable without a packet capture.

Depends on D58732

mdb_counters ATF test exercises all five counters advancing under traffic
and resetting on write. Manual check of the default-off to explicit-on
transition, which no ATF test covers. Full bridge regression at this point
in development: 20/22, with 2 skips for missing scapy on the test VM.
Built and booted on both bases; ATF passes.