[netstack] Invalid TCP checksums for packets from published ports in Docker Desktop

### Description

TCP packets from published ports (on Docker Desktop) are all arriving with invalid checksums.

I believe the issue is that the checksum is initially zeroed out. When the packet is forwarded to the container I think the checksum is recalcluated incorrectly because of the fix to bug #5340

I don't think this is an issue for traffic intended for the container, but when I try to forward the packet to another destination, it is dropped there because of the invalid checksum.

I suggest a fix would be to calculate a fresh checksum when it's zeroed out, otherwise use the incremental update.

### Steps to reproduce

```
~ % docker run -p 19080:19080 --rm -it alpine
/ # apk add tcpdump
fetch https://dl-cdn.alpinelinux.org/alpine/v3.22/main/aarch64/APKINDEX.tar.gz
fetch https://dl-cdn.alpinelinux.org/alpine/v3.22/community/aarch64/APKINDEX.tar.gz
(1/2) Installing libpcap (1.10.5-r1)
(2/2) Installing tcpdump (4.99.5-r1)
Executing busybox-1.37.0-r18.trigger
OK: 9 MiB in 18 packages
/ # tcpdump -vvv -i eth0
tcpdump: listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
```

Also run tcpdump on the Docker VM
```
/mnt # ./tcpdump -vvv -i eth0
tcpdump: listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes
```

Connect to localhost:19080 on host (I used a browser)

Docker VM tcpdump:
```
11:41:17.798844 IP (tos 0x0, ttl 64, id 45890, offset 0, flags [none], proto TCP (6), length 60)
192.168.65.1.65125 > 192.168.65.4.19080: Flags [S], cksum 0x0000 (incorrect -> 0x2eee), seq 1759701479, win 65408, options [mss 65495,nop,nop,TS val 4148726806 ecr 0,nop,wscale 7], length 0
```

Container tcpdump:
```
11:41:17.798951 IP (tos 0x0, ttl 62, id 45890, offset 0, flags [none], proto TCP (6), length 60)
192.168.65.1.65125 > 5c59c61d5332.19080: Flags [S], cksum 0x5597 (incorrect -> 0x8485), seq 1759701479, win 65408, options [mss 65495,nop,nop,TS val 4148726806 ecr 0,nop,wscale 7], length 0
11:41:17.799038 IP (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto TCP (6), length 40)
```

### runsc version

```shell

```

### docker version (if using docker)

```shell
docker version
Client: Docker Engine - Community
Version: 28.3.2
API version: 1.43 (downgraded from 1.51)
Go version: go1.24.5
Git commit: 578ccf6
Built: Wed Jul 9 16:14:01 2025
OS/Arch: linux/arm64
Context: default

Server: Docker Desktop 4.23.0 (120376)
Engine:
Version: 24.0.6
API version: 1.43 (minimum version 1.12)
Go version: go1.20.7
Git commit: 1a79695
Built: Mon Sep 4 12:31:36 2023
OS/Arch: linux/arm64
Experimental: false
containerd:
Version: 1.6.22
GitCommit: 8165feabfdfe38c65b599c4993d227328c231fca
runc:
Version: 1.1.8
GitCommit: v1.1.8-0-g82f18fe
docker-init:
Version: 0.19.0
GitCommit: de40ad0
```

### uname

Linux 5c59c61d5332 6.3.13-linuxkit #1 SMP PREEMPT Thu Sep 7 07:48:47 UTC 2023 aarch64 Linux

### kubectl (if using Kubernetes)

```shell

```

### repo state (if built from source)

_No response_

### runsc debug logs (if available)

```shell

```