Bugfixes for #4589 and #4611

[internet-diglett]

Bugfix for issue #4589.

The root cause ensure_ipv4_nat_entry previously would match against any existing table entries with the matching parameters. We need it to only match against entries that are active, or in implementation terms, entries whose version_removed column is NULL.

The events triggering the bug is as follows:

1. User creates a new instance, eventually triggering the creation of new ipv4 nat entries, which are reconciled by the downstream dendrite workflow.
2. User stops the instance. This triggers the soft-deletion of the ipv4 nat entries, which are again reconciled by the downstream dendrite workflow.
3. The user restarts the instance. In the event that Nexus places the instance back on the same sled as last time, the external_ip may have the same parameters used by the soft-deleted nat records. Since we previously were not filtering for version_removed = NULL in ensure_ipv4_nat_entry, the soft-deleted records would still be treated as "live" in our db query, causing Nexus to skip inserting new nat records when the instance restarts.

This PR should resolve this unwanted behavior. However, a second issue was noticed during verification of the bug fix. I noticed that when running swadm nat list, the entries did not re-appear in the output even though dendrite was indeed picking up the new additions and configuring the softnpu asic accordingly. I believe this was also something @askfongjojo reported in chat. This means that we could have live entries on the switch and external traffic flowing to an instance, even though the nat entry is not appearing in swadm nat list. This PR also includes an upgraded dendrite that resolves that bug.

---

TODO

• Add more robust testing to protect against regressions
• Determine root cause of swadm nat list being incorrect (https://github.com/oxidecomputer/dendrite/pull/688)
• Update dendrite once bugfix is merged
• Delete VM workflow should attempt to remove external addresses in ipv4_nat_entry table #4611

[internet-diglett]

@askfongjojo primary work for resolving #4589 and #4611 are ready for review. Doing some additional testing locally to try to verify fix for #4611, but I'm not sure of the "correct" way to replicate this bug on my local dev machine. 😂

[internet-diglett]

No misbehavior detected in local testing, merging.