fix(net): register provider and fix CIDR parity gaps

[sspaink]

Follow-up to #192 and #193. The BuiltinProvider entry for opa-builtins-net was commented out in its META-INF/services file, so none of the seven net builtins were reachable for consumers.

Registering it exposed 13 failing compliance cases:

• net.cidr_merge gave a bare IPv4 address a /32. Go applies net.IP.DefaultMask(), the classful default, so ["192.0.128.0", "192.0.129.0"] merges to 192.0.128.0/23 rather than two /32s.
• net.cidr_merge threw AddressConversionException on mixed IPv4 and IPv6 input, because mergeToPrefixBlocks cannot span versions. Each version is now merged separately and the results unioned.
• net.cidr_is_valid accepted a bare address such as "192.168.1.2". Go's net.ParseCIDR requires the prefix.
• net.lookup_ip_addr returned IPv6 in Java's uncompressed form (0:0:0:0:0:0:0:1) rather than the canonical ::1 a policy compares against.
• net.cidr_expand and net.cidr_contains_matches reported messages that did not match OPA's wording.

It also rejects the empty string, which no fixture covers. The parser accepts "" and resolves it to the loopback address, so net.cidr_contains("", "127.0.0.1") answered true — a policy gating on an unset CIDR would have allowed the request. Go's ParseCIDR and ParseIP both reject it, so every parse site now sets allowEmpty(false).

Adds CidrBuiltinsTest, including a ServiceLoader assertion; the module had no unit tests, which is why the registration gap went unnoticed. Nine of the eleven tests fail against the unfixed code.

Removes the seven net entries from known-missing-builtins.txt (64 → 57).