fix: enforce TCP isolation on --internal networks by dropping default gateway

[am-saksham]

Fixes #2062

Description

This PR addresses the isolation leak reported in #2062, where containers on --internal (hostOnly) networks were still able to make outbound TCP connections to the public internet by using raw IP addresses.

The root cause was that vmnet in VMNET_HOST_MODE does not prevent the macOS host from NAT-ing and forwarding outbound TCP packets if IP forwarding is enabled. Furthermore, a default gateway was being unconditionally assigned to the guest OS. The integration test previously missed this because it tested a hostname (http://google.com), which failed due to UDP/DNS being blocked, creating a false positive for network isolation.

Changes Made

• ReservedVmnetNetwork.swift: Modified the network provisioning to conditionally assign ipv4Gateway = nil when the network mode is hostOnly.
• NetworkStatus & Attachment: Updated the structs across the networking stack to support an optional ipv4Gateway.
• RuntimeService.swift: Safely unwraps the gateway when generating the container's DNS configuration, gracefully skipping it if the gateway is nil.
• TestCLINetwork.swift: Updated testIsolatedNetwork to verify isolation using a raw IP (https://1.1.1.1/) rather than a hostname. This ensures the test validates the actual TCP egress path rather than just DNS failure.

Testing

• Ran make test locally. The updated testIsolatedNetwork passes, confirming TCP egress is successfully blocked.