ateomnet: enable IPv6 forwarding in worker pod netns

[SURAJ KUMAR (krsnaSuraj)]

ateomnet: enable IPv6 forwarding in the worker pod netns

Fixes: #945

Problem

EnableIPv4Forwarding only wrote /proc/sys/net/ipv4/ip_forward. It had no
IPv6 counterpart, so net.ipv6.conf.all.forwarding stayed at 0 in the worker
pod network namespace. On dual-stack / IPv6-only clusters, every IPv6 packet
an actor sends — including its own DNS queries — is dropped by the kernel's
ip6_forward(), because the packet enters on the actor veth and must be
forwarded out through eth0.

Reproduced as TestActorEgress returning 504 on IPv6-only clusters (4/4 runs).

Fix

EnableIPv4Forwarding now also writes
/proc/sys/net/ipv6/conf/all/forwarding. conf.all.forwarding=1 sets the
forwarding state for all existing interfaces (and is the default for new
ones), so a single write covers both the veth and eth0.

The write is factored into a writeSysctlIfUnset helper that preserves the
original behavior:

• if the sysctl already reads 1, return early (no remount, no write);
• otherwise clear the read-only bind-mount on /proc/sys (the worker holds
  CAP_SYS_ADMIN and uses no user namespace), write 1\n, and restore ro.

Test

internal/ateomnet/write_sysctl_test.go covers the helper's fast paths
(already-set is untouched, unset/zero is written) with a temp file, no root
required. The privileged remount path is exercised by the existing netns
integration tests (withTestNetNS).

Compatibility

• IPv4-only clusters are unaffected (IPv4 path unchanged; writing the IPv6
  sysctl is a no-op where IPv6 is disabled or the file is absent — the helper
  returns nil on missing path).
• No change to the nftables rules; the existing
  InstallActorNftablesRules IPv4-only TODO remains accurate — this PR only
  restores the kernel forwarding path so IPv6 packets reach the pod's eth0.

Verification

• gofmt -l clean.
• go build ./internal/ateomnet/ passes.
• go test ./internal/ateomnet/ -run TestWriteSysctlIfUnset passes.
• Full go test ./internal/ateomnet/ passes.