[multicast] prevent VLAN translation via match key enforcement

[zeeshanlakhani]

Fixes #107.

Stacked on #189.

This adds VLAN-aware NAT ingress matching to prevent cross-VLAN translation.
Previously, a packet arriving with VLAN 100 destined to a multicast group
configured for VLAN 200 would be NAT encapsulated and forwarded, effectively
translating the packet to the wrong customer's network.

NAT ingress table matching (mcast_nat.rs, mod.rs):

• Add Ipv4VlanMatchKey and Ipv6VlanMatchKey that match on destination address,
  VLAN header validity, and VLAN ID
• For groups with VLAN, install two entries: untagged (for decapsulated Geneve
  from underlay) and correctly tagged (for customer packets)
• Packets with the wrong VLAN miss both entries and are not NAT encapsulated

Multicast router VLAN handling (sidecar.p4):

• Strip incoming VLAN tag before routing lookup in MulticastRouter4/6
• forward_vlan action re-adds the group's configured VLAN on egress
• Prevents unintended VLAN translation at the routing stage

Rollback changes:

• Remove dead NAT rollback branches for internal groups (no NAT entries)
• Add rollback support for VLAN changes in NAT and route tables

Counter fix:

• The underlay multicast counter condition was unreachable for packets tagged
  MULTICAST_TAG_UNDERLAY_EXTERNAL that were not decapped. The check for
  == MULTICAST_TAG_UNDERLAY excluded these packets, causing them to fall
  through to the external counter.