Check roles in OPEN and prevent route leaks with Only to Customer (RFC 9234)

A peer's configured role now does three more things:

- Our OPEN carries the BGP Role capability with what we are to the peer.
  A peer whose own says it is something that does not pair with that, or
  that sends two different roles, is refused with OPEN Message Error /
  Role Mismatch. A peer that says nothing is accepted unless require_role
  is set. A role on a peer in our own AS is a configuration error.
- Routes from a provider, a peer or a route server are marked Only to
  Customer on the way in if they are not already, and our routes are
  marked on the way out to a customer, a peer or a route server client.
- A marked route from a customer or route server client, or from a peer
  with someone else's mark, is a leak and is refused. No policy setting
  turns that off.

The packet crate gains the Only to Customer attribute (malformed:
treat-as-withdraw), and the Role Mismatch subcode is corrected from 8 to
11.

The status page shows whether the peer confirmed its role.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

testdata/server.textpb

@@ -23,9 +23,13 @@ peers {
     # them (ADD-PATH). Also ADD_PATH_SEND and ADD_PATH_BOTH. Off by default.
     add_path: ADD_PATH_RECEIVE
     # What the peer is to us: PROVIDER, CUSTOMER, PEER, ROUTE_SERVER or
-    # ROUTE_SERVER_CLIENT. With it, and a validator that has ASPAs, the AS
-    # paths of the peer's routes are verified, and leaked routes refused.
+    # ROUTE_SERVER_CLIENT. With it the peer must not claim to be something
+    # else (RFC 9234), routes are marked "only to customer" and leaks of
+    # marked routes are refused; and with a validator that has ASPAs, the
+    # AS paths of the peer's routes are verified.
     # role: PEER
+    # Refuse the peer if its OPEN does not say what it is.
+    # require_role: true
     # Which of the peer's routes are taken. Without this block the general
     # checks still apply: no private or reserved prefixes or AS numbers,
     # nothing longer than /24 or /48, no default route, and a path that