Add BPF support with tcpdump-style filtering

[jweyrich]

Summary

Implements a complete BPF virtual machine and filter compiler.
Provides native and emulated BPF execution without using any library.
This PR addresses #5.

Features

• Complete VM for BPF: Full instruction set (LD, LDX, ST, STX, ALU, JMP, RET, MISC) with bounds checking
• tcpdump-style filters: Protocol (tcp, udp), host (host 1.1.1.1), port (port 80) with hostname resolution
• Cross-platform: Native Linux/BSD BPF + software emulation fallback (-E flag)
• Smart auto-enabling: BPF filters automatically enable corresponding display protocols

Breaking changes

• Filtering: New mandatory tcpdump-style expression as positional argument: babysniff [OPTIONS] <expression>
• Renamed options:
  • -f/--foreground became -b/--background and now does the opposite
  • -F/--filters became -d/--display-filters and only affect displaying, not filtering