Per-interface MLD report suppression for IXP-facing interfaces (D59160)

Internet Exchange port policies commonly forbid non-unicast frames on
the peering fabric, with a narrow exception for broadcast ARP and
ICMPv6 Neighbor Discovery.  MLD is ICMPv6 but is not ND, so MLD reports
fall under the prohibition.

There is currently no supported way to hold an IPv6 address on a
FreeBSD interface without emitting MLD.  Solicited-node group
membership is mandatory (RFC 4291 2.7.1, RFC 4861 7.2.1) and membership
obliges reporting (RFC 3810 5).  The MLD sysctls select protocol
version behaviour rather than disabling reporting, and are not
per-interface.  The only remedy today is an egress packet filter, which
every operator at an exchange must rediscover independently --
typically after being notified by the exchange that they are in
violation.

This follows the precedent already set by no_dad, no_radr and
no_prefer_iface: per-interface, opt-in, default off, deviating from an
IPv6 RFC where operational policy requires it.  The same behaviour is
available on commercial routers -- Cisco's "no ipv6 mld router" -- and
its absence is a recurring obstacle for FreeBSD-based routers on
exchange fabrics.

The equivalent behaviour, implemented as an ipfw egress filter, has
run in production on AS28585 across eight IX.br localities: no MLD on
any peering VLAN, ND unaffected, all BGP sessions established, and the
exchange confirmed the traffic ceased.

The change is now in review as D59160, tested on 16.0-CURRENT
(n288360).  It adds a regression test to tests/sys/netinet6/mld.sh;
all three cases in that file pass under kyua.  Comments on the
approach welcome, particularly on whether the flag belongs in the nd6
flag word or in mld_ifsoftc.

Best Regards,
Paulo Fragoso
NLINK