VPC router needs to more fully implement system vs. custom

RFD 21 describes two types of routing tables (just called "routers" in the RFD) that apply to each VPC subnet (and therefore any guest interface that lives in that subnet): the VPC System Router and an optional VPC Subnet Custom Router. It then goes on to describe the ordering of route matching based on longest-prefix-match with a tie-break win going to the VPC Subnet Custom Router. The oxide-vpc implementation currently honors the longest-prefix-match, but it does not implement the tie break. Furthermore, it has no real indication of whether a given route came from the system or custom router, as that information isn't passed down from control plane. I think a few things need to happen here.

1. Modify the oxide-vpc API to pass down routes in two distinct lists: system and subnet.
2. Modify control plane to use these new APIs.
3. Add "rule group" functionality to OPTE as described in VFP §5.4. This allows a more straightforward implementation of the tie-break by providing a clear deliniation between the system vs. subnet routes at the OPTE/oxide-vpc level. It may also prove to be a useful feature for other purposes moving forward.
4. Add a series of tests to oxide-vpc exercising the possible combinations of the route selection as described in RFD 21 §2.3.1.

Start with RFD 21 §2.3.1 and VFP §5.4, then inspect the oxide-vpc route APIs and the control-plane route handoff. The work spans separate system and subnet route lists, OPTE rule groups, and oxide-vpc tests covering the documented route-selection combinations. Done means the system-versus-custom longest-prefix tie-break is implemented and tested.