fix: clean up misc TODO comments and improve UDP source filtering (#89)

- http/httpraw: cap header slice growth to pre-allocated capacity, fix
  benchmark to reuse Header across iterations (0 allocs/op)
- internal/ring: replace TODO panic comments with invariant explanations
- tcp/conn: document truncated-frame offset check
- tcp/handler: replace TODO with net.ErrClosed on RST-closed connection
- internet/stack-udpport: filter incoming packets by remote IP address
  when configured via SetStackNode; skip filter for IPv4 multicast
  destinations (class D) so mDNS and similar protocols work correctly

Generated with LLM assistance.

Signed-off-by: Marvin Drees <marvin.drees@9elements.com>

internet/stack-ip6.go

@@ -5,6 +5,7 @@ import (
 
 	"github.com/soypat/lneto"
 	"github.com/soypat/lneto/ethernet"
+	"github.com/soypat/lneto/internal"
 	"github.com/soypat/lneto/ipv6"
 	"github.com/soypat/lneto/tcp"
 	"github.com/soypat/lneto/udp"
@@ -89,7 +90,7 @@ func (si6 *stackip6) demux6(carrierData []byte, offset int) error {
 	}
 	dst := ifrm.DestinationAddr()
 	if si6.ip6 != ([16]byte{}) && *dst != si6.ip6 {
-		if !si6.acceptMulticast || dst[0] != 0xFF {
+		if !si6.acceptMulticast || !internal.IsMulticastIPAddr(dst[:]) {
 			si6.handlers.debug("ip6:not-for-us")
 			return lneto.ErrPacketDrop
 		}