fix(containers): bypass Docker bridge traffic before sidecar TPROXY

[iGmainC]

Summary

Fix local Containers sidecar startup/readiness failures caused by the proxy-everything sidecar intercepting Docker bridge traffic with its TPROXY/DIVERT rules.

The sidecar installs mangle PREROUTING rules for transparent proxying. In local Docker bridge mode, traffic whose source and destination are both inside the Docker bridge CIDR can hit those rules before the container readiness and egress configuration path completes. That can make the local container path time out or fail even though the application container itself is otherwise runnable.

This change installs an idempotent first-position RETURN rule for bridge-CIDR-to-bridge-CIDR traffic inside the sidecar network namespace. The rule is applied after fresh sidecar startup and again when recovering an already-running sidecar after workerd restarts.

Reproduction

Minimal repro: https://github.com/iGmainC/workerd-container-sidecar-tproxy-repro

Validation

• bazel build --action_env=PATH=/home/linuxbrew/.linuxbrew/bin:/bin:/usr/bin:/usr/local/bin --host_linkopt=-L/home/linuxbrew/.linuxbrew/Cellar/llvm/22.1.6/lib --linkopt=-L/home/linuxbrew/.linuxbrew/Cellar/llvm/22.1.6/lib //src/workerd/server:workerd
• Verified locally in a real app using the rebuilt workerd binary: the sidecar now has the bridge bypass rule before the DIVERT/TPROXY rules, and the session stream progresses to assistant/result events instead of hanging at heartbeats.

Fixes #6793

Related to #6790, but this PR targets the distinct sidecar bridge traffic interception issue.