Finalize broker routing and host gateway access

[Weidong Cui (wdcui)]

This PR finalizes broker-controlled Pod routing with the fixed guest identity 10.0.2.15 and host gateway 10.0.2.1, using one shared Guest/Native destination classifier so guest misses fail closed, gateway traffic is authorized through ordinary TCP and UDP destination rules before translation to host loopback, and wildcard native sockets retain guest-visible source identity. It also preserves one native UDP endpoint per broker socket while tracking host and guest-visible peers separately, filters unauthorized native sources, adds the symmetric --allow-udp-destination deployment option, and migrates broker and rewritten guest coverage to the gateway path.

[github-actions]

🤖 SemverChecks 🤖 ⚠️ Potential breaking API changes detected ⚠️

Click for details

--- failure inherent_method_missing: pub method removed or renamed ---

Description:
A publicly-visible method or associated fn is no longer available under its prior name. It may have been renamed or removed entirely.
        ref: https://doc.rust-lang.org/cargo/reference/semver.html#item-remove
       impl: https://github.com/obi1kenobi/cargo-semver-checks/tree/v0.50.0/src/lints/inherent_method_missing.ron

Failed in:
  GuestSocketBinding::requested, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-ulitebox/36a29b7589471f812dc04a7261fd5ae1c2149bdf/litebox_broker_core/src/socket.rs:271
  GuestSocketBinding::guest_source_address, previously in file /home/runner/work/litebox/litebox/target/semver-checks/git-ulitebox/36a29b7589471f812dc04a7261fd5ae1c2149bdf/litebox_broker_core/src/socket.rs:308