perf: add a zero-copy pbuf output path for WireGuard

[kedimuzafer]

Problem

wireguard_udp_output_fn takes a flat byte buffer, so both magicsock output paths in wireguardif.c do this per packet:

uint8_t *data = (uint8_t *)mem_malloc(q->tot_len);
pbuf_copy_partial(q, data, q->tot_len, 0);
device->udp_output_fn(dest_ip, port, data, q->tot_len, ctx);
mem_free(data);

and ml_wg_mgr's callback then has to turn it back into a pbuf for udp_sendto:

struct pbuf *p = pbuf_alloc(PBUF_TRANSPORT, len, PBUF_RAM);
memcpy(p->payload, data, len);
udp_sendto(s_wg_output_pcb, p, &dst, dest_port);
pbuf_free(p);

Two allocations and two ~1.3 KB copies of the same bytes, once per outgoing packet, all on the TCPIP thread.

That thread is the constraint. vTaskGetRunTimeStats on an ESP32-S3 carrying a single 1.4 MB/s TCP stream through the tunnel:

tiT=84% wifi=37% s5_conn=23% IDLE1=6%

The encrypted pbuf is allocated PBUF_TRANSPORT in wireguardif_output_to_peer(), so it already has headroom for the UDP and IP headers — udp_sendto can take it directly.

Change

Adds wireguard_udp_output_pbuf_fn and wireguardif_set_udp_output_pbuf(), and prefers it in both output paths when registered. The existing byte-buffer callback is untouched and still used when no pbuf callback is set, so this is additive — existing integrators are unaffected.

ml_wg_mgr registers one, since it already sends through a raw udp_pcb and never needed the flat buffer.

Ownership is unchanged: udp_sendto does not consume the pbuf, and the callback is synchronous, so wireguardif's existing pbuf_free still applies.

Measured

Single-stream throughput through the tunnel, ESP32-S3 SOCKS5 proxy: 1.44 MB/s → 1.49 MB/s. Modest on its own, but it is 25% of the per-packet work on the thread that is nearest to saturation, so it should matter more on boards or workloads where that thread is the limit.

Independent of #30, #31 and #32.