router: filter IPv4-mapped IPv6 addresses

[matzf]

An IPv6 address can represent an IPv4 address, e.g. the IPv6 address ::ffff:172.20.2.2 represents the IPv4 address 172.20.2.2. This is called IPv4-mapped IPv6 address and is intended as a compatibility mechanism in dual stack hosts. These addresses are not intended to be used on the wire.
The SCION address header has explicit representation for IPv4 or IPv6 addresses with an explicit type discriminator. An IPv4 address can be encoded as either IPv4 type, or as IPv6 type containing an IPv4-mapped IPv6 address.
The latter choice is wasteful (16 bytes instead of 4) and not practically useful. The dual representation could potentially be abused to bypass naive or faulty packet filter implementations.

As there does not appear to be an upside in allowing IPv4-mapped IPv6 addresses in the SCION address header. To reduce the risk of abusive or accidental (as in #4377) use of these mapped addresses, the router should filter these packets. The following two processing rules should be added to the router:

• packets destined for the local AS with an IPv4-mapped IPv6 destination address should be dropped (optional SCMP error message)
• packets originating from the local AS with an IPv4-mapped IPV6 source address should be dropped (optional SCMP error message)