feat: filter uncommon flags combinations

[IustinDumitru]

Overview
Add a filter for invalid TCP flag combinations, preventing security vulnerabilities and resource exhaustion attacks.

Security Vulnerabilities:

1. Combinations with SYN (ie SYN+FIN ): Packets with both SYN and FIN flags set are logically invalid but can cause ,accumulation of half-open connections and PCB resource exhaustion

2. Port Scanning: Attackers use unusual flag combinations to:
   XMAS scan (FIN+URG+PSH)
   NULL scan (no flags)
   FIN scan (only FIN)

3. Protocol Fuzzing:
   Non-compliant implementations send malformed packets that can:
   Trigger edge cases in state machines
   Cause unexpected behavior
   Bypass security filters

Current Behavior:
lwIP processes all flag combinations without validation
Invalid packets like SYN+FIN are processed, creating unstable connection states
No protection against flag-based scanning and attacks

Solution
Implement TCP_VALIDATE_FLAGS_ENABLED feature that:
Validates incoming TCP flags before processing
Maintains whitelist of RFC-compliant flag combinations
Rejects invalid combinations with RST response
Prevents resource exhaustion from malformed packets