Nexus needs to be aware of ASIC limits

This came up in chat. On the colo rack, @augustuswm saw some failures to completely sync the NAT tables for VMs from Nexus to Dendrite. The ultimate cause of that appears to be that we're hitting the NAT table size limit in Dendrite. That's 1024 NAT entries, today, separately for IPv4 and IPv6 addresses.

From the Dendrite logs:

17:27:20.843Z ERRO dpd: failed to add nat entry 172.21.252.58/[16384-32767] -> fd00:1122:3344:10a::1/a8:40:25:f3:40:d3/15436040: TableFull("pipe.Ingress.nat_ingress.ingress_ipv4")
17:27:20.843Z ERRO dpd: unable to create nat entry
    error = TableFull("pipe.Ingress.nat_ingress.ingress_ipv4")

As @internet-diglett pointed out, this is in a Dendrite RPW (not Nexus), and since dpd is pulling the list of NAT entries periodically, there is no way for Nexus to really learn about this error via a response code or similar.

We need to track table size limits like this in Nexus, and fail to provision resources that violate these (external IP addresses in this case). It's not entirely clear how to do that in a way that doesn't make upgrade more difficult. But in the short-term, a set of constants in Nexus that track those in Dendrite seems reasonable, if brittle. Avoiding that kind of cross-consolidation dependency in the longer-term will be very important.