fix(vmm): authorize bridge networking requests

[kvinwang]

Summary

• add a consolidated secure bridge networking design covering deterministic TAP identity, least-privilege enforcement, IPAM, nftables, lifecycle recovery, and rollout
• add root-owned allowed_modes and allowed_bridges policy to VMM networking configuration
• reject unsafe bridge names, non-bridge interfaces, and tenant-selected bridges outside the configured allowlist
• make metadata advertise bridge mode only when the configured bridge policy is usable
• keep the configured default bridge backward compatible while making arbitrary bridge override fail closed

Security invariant delivered by this PR

A tenant RPC can select only a networking mode authorized by the administrator, and bridge mode can attach only to the configured default bridge or an explicitly allowlisted Linux bridge. User-controlled bridge strings no longer reach QEMU unless they are valid Linux interface names and pass both policy and sysfs bridge-type checks.

This is Phase 0 of the included design. It intentionally does not claim MAC/ARP/IP anti-spoofing yet; deterministic TAP creation and the least-privilege enforcement backend are follow-up implementation phases.

Compatibility

• an empty allowed_modes preserves the existing typed mode behavior
• the configured default bridge remains allowed
• an empty allowed_bridges now means no additional tenant-selectable host bridges
• policy-only fields are not serialized into VM manifests

Verification

• cargo test -p dstack-vmm — 59 passed
• cargo clippy -p dstack-vmm --all-targets -- -D warnings
• git diff --check origin/master...HEAD

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.