Explicitly use the alloc op context for dpd nat updates

[zephraph]

There was an issue in main where deleting an instance failed w/ a 403. Digging in further it looked like the 403 was coming from the instance delete saga, specifically the InstanceDeleteNat step that was added in #4610. It turns out that called instance_delete_dpd_config which called boundary_switches with the normal opcontext. Boundary switches calls list_switch_ports_with_uplinks and that requires fleet level permissions.

The fix here was to pass the opcontext_alloc which gives higher level permissions down the boundary_switches call chain.

I believe that we should ultimately try to figure out some way to encode our authz state into the type system such that you can't just pass down a generic opcontext. I'm not exactly sure how we would do that, but it seems worth pursuing.

[zephraph]

I think there's a test failure here. If anyone feels like getting this over the line, please, be my guest.

[zephraph]

@jmpesp I appreciate you!

[smklein]

LGTM, only caveat being "maybe we don't pass the opctx as an argument". But the test makes sense!

[zephraph]

I updated to used the recommended approach (which I just realized was also done in other places).