netstack: Implement implicit source port mapping for DNAT

### Description

Netstack's DNAT implementation doesn't currently use implicit source port mapping to resolve clashes (https://www.netfilter.org/documentation/HOWTO/NAT-HOWTO-6.html):

If a rule is in place that redirects all traffic to 127.0.0.1:1337 and two connections come in from the same source IP and port, then their connections will clash and the second connection will likely fail:

```
1.2.3.4:80 -> 8.8.8.8:82 gets rewritten to 1.2.3.4:80 -> 127.0.0.1:1337
1.2.3.4:80 -> 9.9.9.9:83 gets rewritten to 1.2.3.4:80 -> 127.0.0.1:1337
```

### Is this feature related to a specific bug?

_No response_

### Do you have a specific solution in mind?

If the incoming connection clashes with an existing tuple, the source port should be rewritten if possible. Most of the logic appears to be implemented already, I think it just needs to also be applied to the *source* port when DNAT is performed:

https://github.com/google/gvisor/blob/d1148811c67284def565864b6682aabf7aed07b3/pkg/tcpip/stack/conntrack.go#L719-L823