[dykrsh]

Summary

Add SRC-MAC rules to route traffic by a client's MAC address when mihomo can see the client's original source IP and resolve it through the Linux neighbor table.

# On cache misses, the kernel is queried first (max 100 ms total); optional probing applies only to sources explicitly identified as directly connected via Ethernet.
src-mac-probe: false # Enables active kernel ARP/NDP discovery; requires CAP_NET_ADMIN; disabled by default.
src-mac-timeout: 1000 # Maximum total wait time (ms) shared by kernel queries and probing; range: 1–60000.
# src-mac-interfaces: [br-lan] # Optional interface whitelist; restricts queries/probing to specified interfaces to prevent ARP/NDP leakage onto the WAN.
rules:
  - SRC-MAC,aa:bb:cc:dd:ee:ff,PROXY
  - MATCH,DIRECT

Changes

• Support SRC-MAC in regular rules, logical rules, sub-rules, and classical rule providers.
• Maintain an IPv4 ARP and IPv6 NDP neighbor cache using Linux netlink events. Start the resolver only when active rules need source MAC matching.
• On a cache miss, perform a bounded lookup. Optional active discovery shares the same timeout and can be limited to selected interfaces.
• Add src-mac-probe, src-mac-timeout, and src-mac-interfaces to YAML configuration and the configuration API. Active discovery is disabled by default.
• Expose a resolved MAC as optional sourceMAC connection metadata. Evaluate routing rules without holding the configuration lock while neighbor recovery waits.