CARP VIP on a VLAN-on-bridge interface never receives unicast (if_bridge local delivery — FreeBSD PR 296106)

Tracking/backlink issue as requested by Monviech in the forum thread
(https://forum.opnsense.org/index.php?topic=50260).

Symptom: a CARP VIP configured on a VLAN interface whose parent is a bridge never
receives unicast. ARP for the VIP is answered, CARP election/failover works, firewall logs
show flows as passed — but every unicast frame to the virtual MAC (00:00:5e:00:01:<vhid>)
is treated as unknown unicast and flooded instead of delivered. The VIP is unusable as a
gateway address while looking completely healthy. A VIP untagged on the bridge itself, a
VIP on vlan-over-a-plain-interface, and the vlan interface's own address all work.

Affected: 26.7.1/26.7.2 with the VLAN-on-bridge backport (137513c + 6de81ec), and —
important — reproduced on stock FreeBSD 15.1-RELEASE GENERIC, so it is the native
implementation and 27.1 inherits it unless fixed upstream.

Upstream: FreeBSD PR 296106
(https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=296106) — originally reported in June
against 15.x; we added a minimal two-jail repro (fully in-kernel datapath: vnet jails +
epairs, no NIC/hypervisor in the path) and a code-level analysis: in bridge_input(),
GRAB_OUR_PACKETS(bifp) accepts a unicast as local only on IF_LLADDR(bifp) or
CARP_CHECK_WE_ARE_DST(bifp) = carp_forus(bifp, …), which consults only the bridge
interface's own if_carp; a VHID on the vlan(4) child lives on the vlan's if_carp,
which is never consulted — vlan demux (vlan_input) runs only after a frame is already
accepted as local. So the vlan child's virtual MAC always fails the "ours" test.

Jail repro scripts with the full control matrix are in the forum thread and the PR.