conntrack: icmp_error_count counter + display in stats

ConntrackTable gains icmp_error_count: u64 field, incremented
whenever track_icmp_error() processes an ICMP error that doesn't
match an existing tracked connection.

Stats output now includes:
  icmp_errors: N

Useful for diagnosing ICMP error processing and detecting
anomalies in ICMP error rate.

All 31 tests pass.

netstack/src/filter/conntrack.rs

@@ -166,6 +166,7 @@ pub struct ConntrackTable {
     syn_rate_limits: BTreeMap<IpAddress, (u32, Instant)>,
     icmp_rate_limits: BTreeMap<IpAddress, (u32, Instant)>,
     over_limit_count: u64,
+    icmp_error_count: u64,
 }
 
 fn advance_entry_state(entry: &mut ConnEntry, is_orig: bool, ctx: &PacketContext, now: Instant) -> bool {
@@ -250,6 +251,7 @@ impl ConntrackTable {
             syn_rate_limits: BTreeMap::new(),
             icmp_rate_limits: BTreeMap::new(),
             over_limit_count: 0,
+            icmp_error_count: 0,
         }
     }
 
@@ -481,6 +483,7 @@ impl ConntrackTable {
         if self.entries.contains_key(&inner_key) {
             ConnState::Related
         } else {
+            self.icmp_error_count = self.icmp_error_count.saturating_add(1);
             ConnState::Error
         }
     }
@@ -552,6 +555,7 @@ impl ConntrackTable {
         out.push_str(&alloc::format!("udp_entries: {}\n", udp));
         out.push_str(&alloc::format!("icmp_entries: {}\n", icmp));
         out.push_str(&alloc::format!("over_limit: {}\n", self.over_limit_count));
+        out.push_str(&alloc::format!("icmp_errors: {}\n", self.icmp_error_count));
         out.push_str(&alloc::format!("total_entries: {}\n", self.entries.len()));
         out
     }