…nding_match_and_clear so unsolicited ARP requests can no longer fill the neighbor cache and lock out legitimate replies, with test_arp_request_flood_does_not_lock_out_legit_reply as regression test.

Updated three pre-existing tests to model the now-required solicited-learn path.

….7.3

SND.UNA < SEG.ACK <= SND.NXT on the SYN_SENT RST+ACK path so deletion of the
upper-bound clause and < <-> <= boundary mutations on either bound in tcp_input no
longer slip past CI.

…on's

ethernet branch so the eth filter callback and the eth->type/eth->dst comparisons
can no longer read past the end of a runt caller-supplied buffer, with
test_wolfip_recv_ex_runt_eth_frame_drops_before_filter pinning the contract.

…ecksum

guard in igmp_input so deletion of the rejection branch can no longer slip past CI.

…2-padded

frame whose UDP length overruns its IP packet's declared length can no longer
leak post-IP bytes through recvfrom (per RFC 768 / RFC 791),
with test_regression_udp_len_exceeds_ip_len_dropped pinning the contract.

…s A-record

path with the safe memcpy+ee32 get_be32 helper (hoisted out of the
IP_MULTICAST gate so it is unconditionally available) so a high-bit top
octet (>= 0x80) can no longer trigger ISO C11 6.5.7p4 undefined behavior
on the int shift, with test_regression_dns_callback_high_bit_octet_ip_no_ub pinning
the contract under -fsanitize=undefined.

…ORWARDING

relay path so packets sourced from 127.0.0.0/8 on a non-loopback ingress,
169.254.0.0/16 link-local, or any locally-configured subnet on the wrong
interface are dropped before wolfIP_forward_interface, with
test_regression_forwarding_rpf_drops_spoofed_source pinning the contract.

…a NULL

stack pointer no longer segfaults inside
tcp_new_socket/udp_new_socket/icmp_new_socket/raw_new_socket/packet_new_socket,
with test_regression_sock_socket_null_wolfip_returns_einval pinning the contract.