[MitchDrage]

Description

This PR counts IPv6 traffic in network usage on virtual routers for isolated and VPC networks. Until now only IPv4 was counted on these networks.
IPv6 traffic on shared networks has successfully been counted due to the usage counters measure raw interface traffic which can account for IPv4 and IPv6.
This builds on #14583, which adds network.usage.exempt.cidrs, so this branch includes that commit until #14583 merges.
Related: #14607 applies the network.usage.exempt.cidrs exemptions to VMs on KVM shared networks, for both IPv4 and IPv6. This PR doesn't depend on it.

• A new ip6 cloudstack_usage nftables table copies each IPv4 NETWORK_STATS rule, so both families count the same traffic. VPC routers match on the tiers' IPv6 prefixes.
• The counts are named nftables counters. configure.py rebuilds the rules on every run, and named counters keep their counts through that.
• netusage.sh and vpc_netusage.sh append the IPv6 counts to the IPv4 ones. Every hypervisor adds up that output in sent/received pairs, so no Java changes are needed. Resetting usage resets both families.
• IPv6 addresses in network.usage.exempt.cidrs (from Allow exclusion of chosen addresses from virtual router usage counters #14583) are left out of the IPv6 counts on forwarded traffic, the same way Allow exclusion of chosen addresses from virtual router usage counters #14583 does it for IPv4.
• postinit.sh resets the IPv6 counts after restoring the saved ruleset at boot, so they start from zero like the iptables ones.
• Routed-mode and shared-network routers aren't changed.

Release note, to be added to PendingReleaseNotes once a target release is assigned:

  * Virtual routers on isolated and VPC networks now count IPv6 traffic in
    network usage, using the same rules as IPv4. Dual-stack networks will
    report higher usage once their routers run the new system VM template.
    Operators who already bill IPv6 traffic from an external source should
    stop doing so for these networks, or that traffic will be billed twice.

Fixes: #14591

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• Build/CI
• Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

Screenshots (if appropriate):

How Has This Been Tested?

• Unit tests: TestCsIpv6Usage (the generated rules for isolated and VPC routers, exempt addresses, removed tiers, and routers that are left alone) and TestCsConfig.
• A lab running this branch's router scripts, with an isolated router and a VPC router:
  • IPv6 pings to a normal address showed up in netusage.sh / vpc_netusage.sh output, to the byte. Pings to an exempt address added nothing.
  • IPv4 counts were unchanged.
  • TCP to the router itself was counted, and so was traffic from outside to the VPC router's tier address.
• Not tested on a production router, as none with IPv6 was available.

How did you try to break this feature and the system with this change?

• Restored a saved ruleset holding non-zero IPv6 counts, as a boot would. The reset line in postinit.sh brought them back to zero.
• Read usage on a router where the IPv6 table doesn't exist. The scripts printed the IPv4 counts only and didn't error.
• Rebuilt the rules after counting traffic. The counts stayed the same.
• Reset the global counters with -r while per-interface counters held traffic. Only the global ones went to zero.