Ports opened on a bridged docker network cannot be forwarded to the host

I'm copying the test case from Slack to make it easier to find again: https://cloud-native.slack.com/archives/C043N6ZFV9S/p1747630448275119

```yaml
minimumLimaVersion: 1.1.0

base:
- template://docker-rootful

provision:
- mode: system
script: |
#!/bin/bash
set -eux -o pipefail
docker network create --driver=bridge --subnet=10.10.0.0/24 --attachable test
docker run --rm -d \
--name nginx \
--network=test \
--ip=10.10.0.5 \
-p 127.0.0.5:8080:80 \
nginx
probes:
- script: |
#!/bin/bash
set -eux -o pipefail
if ! timeout 30s bash -c "until curl http://127.0.2.5; do sleep 3; done"; then
echo >&2 "dockerd is not running"
exit 1
fi
hint: See "/var/log/cloud-init-output.log" in the guest
portForwards:
- guestIP: "10.10.0.5" # overrides the default value "127.0.0.1"
guestPort: 80
hostIP: "127.0.0.1" # overrides the default value "127.0.0.1"
hostPort: 8080
- guestIP: "127.0.0.5" # overrides the default value "127.0.0.1"
guestPort: 8080
hostIP: "127.0.0.1" # overrides the default value "127.0.0.1"
hostPort: 8081
```

The `10.10.0.5` port works fine inside the VM:

```console
jan@lima-repro:/Users/jan$ curl http://10.10.0.5

Welcome to nginx!
...
```

But is is never forwarded to the host. The reason is that it isn't being detected by the iptables scraper:

```console
root@lima-repro:~# iptables -t nat -S
-P PREROUTING ACCEPT
-P INPUT ACCEPT
-P OUTPUT ACCEPT
-P POSTROUTING ACCEPT
-N DOCKER
-N LIMADNS
-A PREROUTING -j LIMADNS
-A PREROUTING -m addrtype --dst-type LOCAL -j DOCKER
-A OUTPUT -j LIMADNS
-A OUTPUT ! -d 127.0.0.0/8 -m addrtype --dst-type LOCAL -j DOCKER
-A POSTROUTING -s 10.10.0.0/24 ! -o br-71664da2808d -j MASQUERADE
-A POSTROUTING -s 172.17.0.0/16 ! -o docker0 -j MASQUERADE
-A DOCKER -i br-71664da2808d -j RETURN
-A DOCKER -i docker0 -j RETURN
-A DOCKER -d 127.0.0.5/32 ! -i br-71664da2808d -p tcp -m tcp --dport 8080 -j DNAT --to-destination 10.10.0.5:80
```

Our scraper is only looking for rules from the Kubernetes CNI, like

```
-A CNI-DN-2e2f8d5b91929ef9fc152 -d 127.0.0.1/32 -p tcp -m tcp --dport 8081 -j DNAT --to-destination 10.4.0.7:80
```

Rancher Desktop on Windows uses scrapers that listen to events from the `containerd` and `dockerd` (and Kubernetes) daemons, that should catch these port bindings automatically (but not yet tested). We are planning to port these scrapers over to Lima, which hopefully will address this issue.