fix: enable mld listener queries, disable multicast snooping

[r-birkner]

A few SEV-enabled machines fail to upgrade, however after a reboot the upgrade all of a sudden succeeds. The guest does not respond to MLD queries (firewall blocks them) and as a consequence, the bridge in the HostOS does not flood the group and neighbor discovery messages to the guest. This prevents the upgrade VM to connect to the active VM. This only happens if there is an active MLD querier around (switch/router). We see this issue only on very few machines.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 5d9f9de.

Security Overview

• 🔎 Scanned files: 9 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/f5e9d2bb-29a4-4b64-902a-391d65fd8b2d?scanId=2c133362-09b7-4cde-84b9-6da6c628bbfb&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► ic-os/components/networking/nftables/hostos/nftables.template     Add mld-listener-query to ip6 filter block ► rs/ic_os/config/tool/templates/ic.json5.template     Add mld-listener-query to ip6 filter block (three occurrences)
Enhancement	► rs/ic_os/networking/network/src/systemd.rs     Update Bridge STP and MulticastSnooping settings
Enhancement	► rs/orchestrator/testdata/nftables_assigned_cloud_engine.conf.golden     Include mld-listener-query in ip6 filter block ► rs/orchestrator/testdata/nftables_assigned_replica.conf.golden     Include mld-listener-query in ip6 filter block ► rs/orchestrator/testdata/nftables_boundary_node_app_subnet.conf.golden     Include mld-listener-query in ip6 filter block ► rs/orchestrator/testdata/nftables_boundary_node_system_subnet.conf.golden     Include mld-listener-query in ip6 filter block ► rs/orchestrator/testdata/nftables_unassigned_cloud_engine.conf.golden     Include mld-listener-query in ip6 filter block ► rs/orchestrator/testdata/nftables_unassigned_replica.conf.golden     Include mld-listener-query in ip6 filter block

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 5d9f9de.

Security Overview

• 🔎 Scanned files: 9 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6992424c-495e-4621-b441-efd6821a4be6?scanId=fab88caa-322a-4143-9eef-6d9a46d2612f&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► ic-os/components/networking/nftables/hostos/nftables.template     Add mld-listener-query to ip6 filter block ► rs/ic_os/config/tool/templates/ic.json5.template     Add mld-listener-query to ip6 filter block (three occurrences)
Enhancement	► rs/ic_os/networking/network/src/systemd.rs     Update Bridge STP and MulticastSnooping settings
Enhancement	► rs/orchestrator/testdata/nftables_assigned_cloud_engine.conf.golden     Include mld-listener-query in ip6 filter block ► rs/orchestrator/testdata/nftables_assigned_replica.conf.golden     Include mld-listener-query in ip6 filter block ► rs/orchestrator/testdata/nftables_boundary_node_app_subnet.conf.golden     Include mld-listener-query in ip6 filter block ► rs/orchestrator/testdata/nftables_boundary_node_system_subnet.conf.golden     Include mld-listener-query in ip6 filter block ► rs/orchestrator/testdata/nftables_unassigned_cloud_engine.conf.golden     Include mld-listener-query in ip6 filter block ► rs/orchestrator/testdata/nftables_unassigned_replica.conf.golden     Include mld-listener-query in ip6 filter block