Support IPv6 networking and egress policies

Add IPv6 connectivity and egress-policy enforcement to NVX's portable network profile.

This needs a working IPv6 path through the guest and network backend, not just acceptance of IPv6 rule text.

Example	Expected behaviour
With egress denied by default, allow `2001:db8:1::/64` on TCP port `443`	Allow matching connections; keep other IPv6 destinations and ports blocked.
Also deny `2001:db8:1::123/128`	The explicit deny overrides the broader allow rule.
Deny egress with no allow rules	Block IPv6 as well as IPv4; IPv6 must not provide an alternate path around the policy.
Configure separate IPv4 and IPv6 rules	Enforce each rule for its address family without unintentionally widening access in the other family.
Match all destinations	Support the IPv6 wildcard `::/0` alongside the existing IPv4 wildcard `0.0.0.0/0`.

Preserve existing IPv4 behaviour. Verify allowed and denied IPv6 traffic using a working IPv6 connection as the positive control; a missing route or disabled IPv6 stack must not count as successful policy enforcement.

The example addresses are documentation addresses; live tests should use reachable, controlled IPv6 endpoints.

MXC schema requirement: network.egress.allow[].to[].cidr and network.egress.deny[].to[].cidr accept IPv4 or IPv6 CIDRs. Omitting to matches both IP families.

microVM: add IPv6 to the portable network profile and its egress rules

openvmm: pin IPv6 in the portable network profile and its egress rules