Add nft-dump utility for firewall test verification

- Create nft-dump Go utility that uses nftables library to inspect firewall
  rules without requiring nft CLI. Outputs human-readable YAML with
  interpreted values (IP addresses, ports, marks, etc.)

- Update Garden firewall tests to use nft-dump instead of nft CLI for
  verifying firewall rules work correctly in containers

- Fix Jammy stemcell container tests by unmounting Garden's bind-mounted
  /etc/resolv.conf, /etc/hosts, /etc/hostname before starting the agent.
  This prevents the 'Device or resource busy' error when the agent runs
  resolvconf -u (same approach used by bosh-warden-cpi)

- Add nft-dump helper methods to GardenClient and TestEnvironment for
  use in both container and VM-based integration tests

- Update deploy-to-noble.sh to build nft-dump binary for container tests

Tests now pass for both Noble and Jammy stemcells.

Author: rkoster

deploy-to-noble.sh

@@ -113,7 +113,7 @@ instance_groups:
   - name: ${INSTANCE_GROUP}
     azs: [z1]
     instances: 1
-    vm_type: default
+    vm_type: garden-test
     stemcell: stemcell
     networks:
       - name: default
@@ -207,6 +207,8 @@ show_help() {
     echo "  INSTANCE_GROUP          - Instance group name (default: agent-test)"
     echo "  INSTANCE_ID             - Instance ID (default: 0)"
     echo "  GARDEN_RUNC_RELEASE_PATH - Path to garden-runc-release (default: ~/workspace/garden-runc-release)"
+    echo "  STEMCELL_IMAGE          - Specific stemcell image to test (default: tests both Noble and Jammy)"
+    echo "                            Example: STEMCELL_IMAGE=docker://ghcr.io/cloudfoundry/ubuntu-jammy-stemcell:latest"
 }
 
 # Check Garden status
@@ -240,6 +242,10 @@ run_garden_tests() {
     cd "$SCRIPT_DIR"
     CGO_ENABLED=0 GOARCH=amd64 GOOS=linux go build -o bosh-agent-linux-amd64 ./main
 
+    # Build nft-dump utility for inspecting nftables without nft CLI
+    log_info "Building nft-dump utility for container tests..."
+    CGO_ENABLED=0 GOARCH=amd64 GOOS=linux go build -o nft-dump-linux-amd64 ./integration/nftdump
+    
     # Determine SSH key path for agent VM
     local ssh_key_path
     if [[ -f "${SCRIPT_DIR}/debug-ssh-key" ]]; then