fix(rust-plugins): SNMP protocol hardening — validate agent responses, bound walks, timeouts & retries

[julienmathis]

Summary

The SNMP engine blindly trusted the agent it queried — yet the agent is precisely the untrusted party of the dialogue.

• Agent errors are now detected: a response with error-status != 0 produces a typed error naming the RFC 3416 status, e.g. UNKNOWN: SNMP agent returned an error: noSuchName (status 2, index 3).
• Request/response correlation: every request now carries a fresh request-id, and received datagrams are validated (request-id, community echo, PDU type) before being accepted — an unrelated datagram (e.g. a late retransmission of a previous request) is discarded instead of being consumed as the current answer.
• Bounded walks: OIDs must be strictly increasing during a walk (the classic snmpwalk "OID not increasing" guard) and a single walk may collect at most 100 000 values — both protect against a buggy or malicious agent looping the walk or streaming endless data.
• Configurable timeouts and retries, three new CLI options:

  Option	Default	Role
  --timeout <s>	1	Receive timeout per request attempt
  --snmp-retries <n>	2	Retries after a timed-out attempt
  --collect-timeout <s>	50	Global budget for the whole collection (all gets + walks share one deadline) — exits with a clean UNKNOWN before centengine's kill timeout

• The UDP receive buffer was 1024 bytes, silently truncating large bulk responses; raised to 65535.

Connection parameters (target, community, timeouts, retries) are now threaded through a single SnmpConfig instead of loose string arguments, and the two walk loops (snmp_bulk_walk / snmp_bulk_walk_with_labels) share one implementation.

Test plan

• cargo build --release succeeds
• cargo test: 75 passed, 0 failed (10 new tests: RFC 3416 error names, response validation — valid / wrong id / wrong community / agent error —, non-increasing OID ×2, varbind cap, expired deadline)
• Manual check against an unroutable address (TEST-NET, 203.0.113.1):
  • default settings → UNKNOWN: No valid SNMP response from 203.0.113.1:161 after 2 attempts (timeout 1s per attempt) after ~2s, exit 3
  • --collect-timeout 2 with a longer per-attempt timeout → UNKNOWN: SNMP collection exceeded the global timeout of 2s after ~2s, exit 3 — the global budget correctly preempts the attempt schedule