controller: Add option to make port security compliant with RFC 9568.

The RFC defines a Virtual Router Redundancy Protocol [0], in order
for that protocol to work the workload might "spoof" MAC address
within ARP or ND request/response. This wasn't allowed as the port
security is specifically designed against spoofing and checks if
the port security MAC address is the same for source of ARP/ND
and the inner source/target address. To make the port security
compliant add a special literal which when specified will allow
user to add any/all MAC addresses defined by VRRPv3. The traffic
from and to those additional MAC addresses will be allowed as
well as permutations of ARP/ND inner MACs combined with the
physical MAC as a source.

[0] https://datatracker.ietf.org/doc/html/rfc9568
Reported-at: https://issues.redhat.com/browse/FDP-2979
Acked-by: Ilya Maximets <i.maximets@ovn.org>
Acked-by: Dumitru Ceara <dceara@redhat.com>
Signed-off-by: Ales Musil <amusil@redhat.com>
(cherry picked from commit d9e2393)

Author: almusil

NEWS

@@ -1,5 +1,8 @@
 OVN v25.09.3 - xx xxx xxxx
 --------------------------
+   - Add support for special port_security prefix "VRRPv3". This prefix allows
+     CMS to allow all required traffic for a VRRPv3 virtual router behind LSP.
+     See ovn-nb(5) man page for more details.
 
 OVN v25.09.2 - 04 Dec 2025
 --------------------------