UDP close removes only one firewall rule

1. Problem
A UDP socket can have many firewall rules. On close, the code calls:
```cpp
firewall_remove_udpipv4_local_endpoint(localPort);
```
[[Close path](https://github.com/CHERIoT-Platform/network-stack/blob/58425e6a1c65c4357b037aa817ba492e7a8fa70b/lib/tcpip/network_wrapper.cc#L956-L959)](https://github.com/CHERIoT-Platform/network-stack/blob/58425e6a1c65c4357b037aa817ba492e7a8fa70b/lib/tcpip/network_wrapper.cc#L956-L959)

However, the remove loop stops after the first match:
```cpp
table.remove(&tuple);
break;
```
[[Remove loop](https://github.com/CHERIoT-Platform/network-stack/blob/58425e6a1c65c4357b037aa817ba492e7a8fa70b/lib/firewall/firewall.cc#L625-L631)](https://github.com/CHERIoT-Platform/network-stack/blob/58425e6a1c65c4357b037aa817ba492e7a8fa70b/lib/firewall/firewall.cc#L625-L631)

2. Why is it bad
One UDP socket may allow many remote hosts. These rules all have the same local port. Closing the socket removes only one hole. The other holes stay in the firewall.

3. Suggested fix
Remove every UDP rule with the matching local port. Do this for both IPv4 and IPv6.

Start in lib/tcpip/network_wrapper.cc at the UDP close path and inspect the removal loop in lib/firewall/firewall.cc. Reproduce or trace a socket with multiple remote hosts, then verify that closing it removes every matching UDP rule for both IPv4 and IPv6, rather than leaving rules with the same local port.

Written by the indexing model from the issue text.