Install a full table in the kernel in about a second

A million IPv4 routes took 1.6 s to install (release build); they take
1.1 s now, and 0.5 s to remove instead of 1.15 s. Most of what is left is
the kernel's own work on each route.

- Nexthop objects (Linux 5.3 and later): a gateway is put in the kernel
  once and routes name it, so the kernel checks it once and not for every
  route. The daemon makes its own objects, uses nobody else's, is told
  when one of its own is removed and puts it back, and removes them when
  it stops, which takes all the routes that name them along at once.
  `without_nexthop_objects` turns this off; a kernel without them is
  noticed and served as before.
- Writing to the kernel is a task of its own, fed through a short queue,
  so the next batch is worked out while the kernel is busy with the last.
  "In step" is said when the kernel has done the batch that completes the
  table, not when it was handed over.
- What a next hop resolves to is kept, by next hop: it was looked up among
  the machine's addresses for every route.
- A quicker hash for the plan's maps, and no lookups in the ones that are
  empty.

Fixes a hole found on the way: when an interface went down and came back
within the second it takes us to react, the kernel had dropped our routes
and we did not put them back, since nothing about them had changed for
us. After such a change the kernel is now asked what it actually has.

scripts/in-namespace.sh runs one command in a scratch namespace;
FERRIX_ROUTES sets the size of the timing test.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

scripts/kernel-tests.sh

@@ -19,20 +19,8 @@ cargo build --locked -p bgp
 cargo test --locked -p bgp-fib --test kernel --no-run
 cargo test --locked -p bgp-integration-tests --test kernel --no-run
 
-namespace="ferrix-test-$$"
-sudo modprobe dummy 2>/dev/null || true
-sudo ip netns add "$namespace"
-trap 'sudo ip netns del "$namespace"' EXIT
-sudo ip netns exec "$namespace" ip link set lo up
-
-# In the namespace, as the user, with CAP_NET_ADMIN and nothing else.
-in_namespace() {
-    sudo ip netns exec "$namespace" \
-        setpriv --reuid "$(id -u)" --regid "$(id -g)" --init-groups \
-        --inh-caps +net_admin --ambient-caps +net_admin \
-        env PATH="$PATH" HOME="$HOME" CARGO_TARGET_DIR="${CARGO_TARGET_DIR:-}" "$@"
-}
-
-in_namespace cargo test --locked -p bgp-fib --test kernel -- --include-ignored --nocapture "$@"
-in_namespace cargo test --locked -p bgp-integration-tests --test kernel -- --include-ignored --nocapture "$@"
+# Each in a namespace of its own, as the user, with CAP_NET_ADMIN and
+# nothing else.
+scripts/in-namespace.sh cargo test --locked -p bgp-fib --test kernel -- --include-ignored --nocapture "$@"
+scripts/in-namespace.sh cargo test --locked -p bgp-integration-tests --test kernel -- --include-ignored --nocapture "$@"
 scripts/two-routers.sh