[roll] Roll fuchsia [netstack3] Cache weak address ID in NAT config

Currently the Masquerade and Redirect NAT configurations retrieve an
interface's address when they are configured, write that into the reply
tuple for the connection, and then use that address indefinitely. If the
address is removed, the NAT config will continue to use that address.

For Redirect (on INGRESS) this does not pose a big problem, because if
the address is no longer assigned to the ingress interface, the packet
will fail to be delivered anyway; however, for Masquerade, this means
that the packet will egress with a source address that is no longer
assigned to the interface (and therefore cannot receive reply traffic).

Instead, modify the NAT config to optionally store a weak reference to
the address it is using, so that it can check for each packet whether
the address is still valid by attempting to upgrade the weak reference.
If it discovers the address has been removed, it attempts to acquire a
new handle to the same address. (NB: we cannot make use of a new address
because it would break the existing connection with the remote.) If the
interface does not have the address assigned, just drop the packet. We
don't remove the connection entirely in that case in order to allow the
connection to recover if the address eventually comes back. (If it never
does, the connection along with its NAT configuration should eventually
time out and get garbage-collected; NAT can be freshly configured for a
new connection.)

Original-Bug: 372546692
Test: netstack3-filter-test
      netstack-filter-fidl-tests
Original-Reviewed-on: https://fuchsia-review.googlesource.com/c/fuchsia/+/1164034
Original-Revision: e770f1901a9f94ab8b00ce078d5b6b863c2ddcb8
GitOrigin-RevId: 9c132cb5c93a188dd8056c966c826854c2fc38d4
Change-Id: I2dcebf8555756bd1446272ab4ea846f5a3f010da