Make the vmnet caller responsible for a zoneless prefix

Per review, the vmnet path no longer strips the zone itself. It renders
`lower` as-is and checks the `inet_pton` result, so a prefix it cannot parse
is rejected instead of quietly accepted, leaving the caller responsible for
supplying a zoneless prefix.

Checking the result also closes a pre-existing hole: it was discarded, so an
address `inet_pton` refused left the buffer zeroed and configured `::`.

Author: vyncint

Sources/Containerization/VmnetNetwork.swift

@@ -291,10 +291,13 @@ public struct VmnetNetwork: Network {
 
     private static func configurePrefixV6(_ config: vmnet_network_configuration_ref, prefixV6: CIDRv6) throws {
         var p = in6_addr()
-        // `inet_pton` rejects a zone suffix, so render the network address on
-        // its own. A vmnet prefix is never link-scoped, so dropping the zone
-        // here loses nothing.
-        inet_pton(AF_INET6, IPv6Address(prefixV6.lower.value).description, &p)
+        // `inet_pton` rejects a zone suffix, and a vmnet prefix is never
+        // link-scoped, so the caller is responsible for supplying a zoneless
+        // prefix. Check the result: ignoring it leaves `p` zeroed and
+        // configures `::` on anything that fails to parse.
+        guard inet_pton(AF_INET6, prefixV6.lower.description, &p) == 1 else {
+            throw ContainerizationError(.invalidArgument, message: "invalid IPv6 prefix \(prefixV6) for network")
+        }
 
         guard vmnet_network_configuration_set_ipv6_prefix(config, &p, prefixV6.prefix.length) == .VMNET_SUCCESS else {
             throw ContainerizationError(.internalError, message: "failed to set IPv6 prefix \(prefixV6) for network")