feat(compute): report uBridge tc capabilities and gate filters on them

Consume uBridge's ebpf_modes contract (feature/tc-window 40c36ae): a
stateful mode is usable iff ebpf=1 and its token is listed; builds
predating the field keep their shipped modes (nth/quota/flow), so the
pre-correction window semantics can never be installed silently.

- gns3server/utils/tc_capabilities.py: shared reply parser, mode
  policy and filter-type mappings (compute and controller gate on the
  same rules)
- gns3server/compute/ubridge/tc_probe.py: standalone probe spawning a
  throwaway uBridge as the server's own user, cached by binary
  identity (path/mtime/size - the version string cannot distinguish
  rebuilds); failures cache as unknown
- GET /v3/compute/capabilities gains ubridge_tc {netem, ebpf,
  ebpf_modes, cbpf}; the controller forwards it (Compute.capabilities)
  and available_filters hides kernel-datapath filter types an endpoint
  compute cannot run (both ends apply their own filters, so one
  incapable compute hides the type); computes without a report keep
  the full list and apply-time 409 stays the guard
- docker: _ubridge_apply_ebpf_drops gates per mode token; the cleanup
  path only sends "off" for modes the build declares
- split DockerVM's kernel-datapath machinery (veth lifecycle, carrier,
  marker primitives, tc filter translation, kernel NIO teardown) into
  compute/docker/docker_kernel_datapath.py (DockerKernelDatapathMixin)

gns3server/controller/compute.py

@@ -92,7 +92,15 @@ class Compute:
         self._disk_usage_percent = 0
         self._last_error = None
         self._ssl_context = ssl_context
-        self._capabilities = {"version": "", "platform": "", "cpus": 0, "memory": 0, "disk_size": 0, "node_types": []}
+        self._capabilities = {
+            "version": "",
+            "platform": "",
+            "cpus": 0,
+            "memory": 0,
+            "disk_size": 0,
+            "node_types": [],
+            "ubridge_tc": None,
+        }
         self.name = name
         # Cache of interfaces on remote host
         self._interfaces_cache = None
@@ -288,6 +296,15 @@ class Compute:
     def disk_usage_percent(self):
         return self._disk_usage_percent
 
+    @property
+    def capabilities(self) -> dict:
+        """
+        Capabilities reported by this compute (fetched from GET /capabilities
+        at connect time).
+        """
+
+        return self._capabilities
+
     def asdict(self, topology_dump=False):
         """
         :param topology_dump: Filter to keep only properties require for saving on disk