feat(docker): bpf packet filter on kernel links via cls_bpf match-drop

The GNS3 bpf filter (one expression per line, any line matching drops the
packet) now runs on the kernel datapath: uBridge's tc bpf_drop compiles
each line with libpcap (same compiler as the relay filter) into classic
BPF, attaches it to the veth host end's clsact egress as a cls_bpf
classifier with a gact TC_ACT_SHOT action, and the kernel migrates the
cBPF to eBPF internally -- no CAP_BPF needed.

- reconcile is flush + one add per line at priorities 10, 11, ... (OR
  semantics, same as the relay's per-line filters); tc reset (link
  delete / clear) is the full restore in uBridge and clears them
- capability-gated: the compute probes "tc capabilities" once per uBridge
  process (cached, invalidated on stop); without cbpf=1 the filter apply
  fails with an actionable upgrade error, and old uBridge builds without
  the tc module are never touched when no bpf filter is present
- a line that compiled for the controller's tcpdump but not for the
  compute's uBridge libpcap is skipped with a warning, mirroring the
  relay path
- KERNEL_UNSUPPORTED_FILTERS shrinks to frequency_drop (its eBPF stateful
  classifier is still pending, spec part B)

e2e (22/22): bpf "icmp" = 100% loss; size-discriminating expression
("greater 150") passes 98-byte and drops 300-byte pings (real byte-level
match); two-line OR; coexistence with netem (delay 50 -> small pings
100.2 ms while big dropped); clear removes clsact; suspend/resume keeps
the drops; link delete + recreate leaves no residual filters.

gns3server/utils/packet_filter_validation.py

@@ -15,10 +15,12 @@ class FilterValidationError(Exception):
     pass
 
 
-# Packet filters with no kernel-datapath equivalent (no tc netem mapping):
-# they only run in the uBridge userspace relay, so a link carrying one is
-# wired on the relay, and adding them to a kernel-datapath link is rejected.
-KERNEL_UNSUPPORTED_FILTERS = frozenset({"frequency_drop", "bpf"})
+# Packet filters with no kernel-datapath equivalent yet: frequency_drop needs
+# the eBPF stateful classifier (frozen in
+# docs/design/ubridge-kernel-impairment-spec.md, part B — not delivered),
+# so it still only runs in the uBridge userspace relay. bpf is served by the
+# cBPF match-drop classifier (tc bpf_drop) when uBridge reports cbpf=1.
+KERNEL_UNSUPPORTED_FILTERS = frozenset({"frequency_drop"})
 
 
 def validate_bpf_syntax(bpf_expression: str) -> Dict[str, Optional[str]]: