Implement the debugnet KPI in rge(4) so a panicking kernel can dump its core image over a Realtek 2.5GbE NIC.

Mirrors the re(4) pattern: rge_debugnet_transmit() bypasses the asynchronous sc_txq/taskqueue path (taskqueues cannot run in panic
context) and inlines the synchronous rge_encap() + RGE_TXSTART doorbell write.
rge_debugnet_poll() drains TX completions with rge_txeof(), then runs rge_rxeof() with a local mbufq and feeds each received mbuf
back through if_input() so debugnet's overridden if_input handler can observe ARP replies and netdumpd ACKs - rge_rxeof() does not call
if_input() itself, the interrupt handler normally drains the mbufq
after dropping the lock, and that step has to be reproduced here.