Tunnel decapsulation: VXLAN, GTP-U, Geneve, GRE, IP-in-IP

[Akmot9]

Follow-up of the recursive tunnel decapsulation shipped in 6637db0 (CAPWAP → 802.11 → LLC/SNAP). Detailed design notes and how-to in TODO_TUNNELS.md.

Rule: one golden test per tunnel with a real frame (full hex from Ethernet) — nothing merges without it.

UDP tunnels (existing detect_inner() hook — easiest)

• VXLAN — UDP 4789, 8-byte header, inner = Ethernet
• GTP-U — UDP 2152, variable header (E/S/PN flags, message type 255 = G-PDU), inner = raw IP
• Geneve — UDP 6081, 8-byte header + options, protocol type says Ethernet (0x6558) or IP

IP-level tunnels (need a new hook: detect_inner() currently only runs when transport is Some)

• IP-in-IP — IP proto 4/41, inner = raw IP
• GRE — IP proto 47, optional fields per C/K/S bits, EtherType says IP or Ethernet (NVGRE)

Documented limits (nothing to code)

• CAPWAP-DTLS and ESP are encrypted → no recursion, outer line only (already handled)
• MPLS (0x8847/0x8848) is L2.5, out of scope for now