sysctl: add /scheme/netcfg/sysctl tree with ip_forward toggle

Router gains Rc<Cell<bool>> ip_forward flag (default: true).
When false, forward_packets() returns immediately — no packets forwarded
between interfaces. Security best practice for non-router hosts.

netcfg scheme gains sysctl subtree:
  /scheme/netcfg/sysctl/net/ipv4/ip_forward  (rw: 0 or 1)

Read:  echo /scheme/netcfg/sysctl/net/ipv4/ip_forward  →  1
Write: echo 0 > /scheme/netcfg/sysctl/net/ipv4/ip_forward  (disable)
Restore: echo 1 > /scheme/netcfg/sysctl/net/ipv4/ip_forward

Mirrors Linux /proc/sys/net/ipv4/ip_forward.
Shared via Rc<Cell<bool>> between Router and NetCfgScheme.

netstack/src/scheme/mod.rs

@@ -116,6 +116,8 @@ impl Smolnetd {
             |_timestamp, printer| trace!("{}", printer),
         );
 
+        let ip_forward = network_device.get_mut().ip_forward.clone();
+
         let config = Config::new(HardwareAddress::Ip);
         let mut iface = SmoltcpInterface::new(config, &mut network_device, Instant::now());
         iface.update_ip_addrs(|ip_addrs| ip_addrs.extend(protocol_addrs));
@@ -190,6 +192,7 @@ impl Smolnetd {
                 Rc::clone(&route_table),
                 Rc::clone(&devices),
                 Rc::clone(&socket_set),
+                ip_forward,
             )?,
             netfilter_scheme: NetFilterScheme::new(
                 netfilter_file,