Add a NAT variant for debuggers on a different subnet or reached only
through the host uplink. Source NAT suffices because KDNET is target
initiated, so replies return along the conntrack entry with no inbound
port forward.
Note that KDNET needs a routable tap address from DHCP or a static SAC
assignment, add SAC steps to enable it on a headless guest, and move
busparams pinning into an optional section.
Assisted-by: Claude:Opus-4.8
Signed-off-by: Anatol Belski <anbelski@linux.microsoft.com>
9ea9019d29