feat(compute): report uBridge tc capabilities and gate filters on them

Consume uBridge's ebpf_modes contract (feature/tc-window 40c36ae): a
stateful mode is usable iff ebpf=1 and its token is listed; builds
predating the field keep their shipped modes (nth/quota/flow), so the
pre-correction window semantics can never be installed silently.

- gns3server/utils/tc_capabilities.py: shared reply parser, mode
  policy and filter-type mappings (compute and controller gate on the
  same rules)
- gns3server/compute/ubridge/tc_probe.py: standalone probe spawning a
  throwaway uBridge as the server's own user, cached by binary
  identity (path/mtime/size - the version string cannot distinguish
  rebuilds); failures cache as unknown
- GET /v3/compute/capabilities gains ubridge_tc {netem, ebpf,
  ebpf_modes, cbpf}; the controller forwards it (Compute.capabilities)
  and available_filters hides kernel-datapath filter types an endpoint
  compute cannot run (both ends apply their own filters, so one
  incapable compute hides the type); computes without a report keep
  the full list and apply-time 409 stays the guard
- docker: _ubridge_apply_ebpf_drops gates per mode token; the cleanup
  path only sends "off" for modes the build declares
- split DockerVM's kernel-datapath machinery (veth lifecycle, carrier,
  marker primitives, tc filter translation, kernel NIO teardown) into
  compute/docker/docker_kernel_datapath.py (DockerKernelDatapathMixin)

gns3server/schemas/controller/capabilities.py

@@ -15,13 +15,27 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 
-from typing import List
+from typing import List, Optional
 
 from pydantic import BaseModel, Field
 
 from .nodes import NodeType
 
 
+class UbridgeTcCapabilities(BaseModel):
+    """
+    uBridge tc-module capabilities (kernel-datapath packet filters), probed
+    by the compute as its own user.
+    """
+
+    netem: List[str] = Field(..., description="netem keywords supported by this uBridge's tc module")
+    ebpf: bool = Field(..., description="Whether the eBPF stateful classifier loads on this host")
+    ebpf_modes: List[str] = Field(
+        ..., description="eBPF classifier modes usable on this host (ebpf is on and the mode token is declared)"
+    )
+    cbpf: bool = Field(..., description="Whether classic-BPF match-drop classifiers are available")
+
+
 class Capabilities(BaseModel):
     """
     Capabilities properties.
@@ -33,3 +47,6 @@ class Capabilities(BaseModel):
     cpus: int = Field(..., description="Number of CPUs on this compute")
     memory: int = Field(..., description="Amount of memory on this compute")
     disk_size: int = Field(..., description="Disk size on this compute")
+    ubridge_tc: Optional[UbridgeTcCapabilities] = Field(
+        None, description="uBridge tc-module capabilities; absent when the probe failed or uBridge has no tc module"
+    )