Enforce large IPv4 CIDRs without expanding them into individual addresses

[JimBugwadia]

User outcome

Operators can express enterprise network ranges such as 10.0.0.0/8 with bounded policy cost.

Current behavior

ParseTargets expands /24 through /32 into exact address keys and rejects wider ranges; each allow/deny map holds 1024 addresses.

Scope

• Introduce prefix-aware maps, preferably LPM tries, and one shared parsing/rejection path.
• Preserve explicit deny precedence and cross-policy allow/default-deny semantics; do not let longest-prefix lookup silently change them.
• Keep capacity bounded and failures visible.

Acceptance

• /8, /24, /32 and /0 tests include boundaries, overlapping allow/deny prefixes and multiple policies.
• Each CIDR costs one prefix entry rather than all contained addresses.
• Policy replacement/deletion, capacity failures, and monitor/enforce agreement are tested.

Dependencies and boundaries

Child of #65. Coordinate key representation with IPv6; no dependency on event-source work.

Validation and completion

• Table-driven tests pin the stated invariant, including invalid input and policy updates.
• For code changes: make build and make test; significant changes also require make kind-install and a targeted behavioral check. Pipeline, collector, evaluator, or reporter changes require make smoke-quickstart.
• Kernel changes use the pinned BPF builder, generated-artifact verification, verifier loading, and allowed/denied behavior tests on supported hook paths.
• Update DESIGN, development guidance where affected, and the RuntimePolicy reference and limits. Every rejected user rule must reach an operator log and policy condition; count every observation drop. Preserve the reporter redaction boundary.