netlink: deny socket families outside a small allowlist

[congwang-mk]

Summary

• Switches handle_socket from a AF_NETLINK-only special case to a tiny allowlist (AF_UNIX, AF_INET, AF_INET6, AF_NETLINK); everything else returns EAFNOSUPPORT. This closes off AF_ALG (Copy Fail / CVE-2026-31431 entry point), AF_PACKET, AF_VSOCK, AF_XDP, AF_TIPC, and the rest of the niche socket-family LPE surface in one place rather than chasing CVEs per family.
• Two regression tests: af_alg_socket_blocked asserts the exact errno (97) that an attempted socket(AF_ALG, SOCK_SEQPACKET, 0) should see, mirroring Copy Fail's exact opener; niche_socket_families_blocked covers the broader class.
• Pre-existing tests across network, port_remap, http_acl, landlock, seccomp_enforce (27+) all pass — AF_INET / AF_INET6 / AF_UNIX / AF_NETLINK paths are unaffected.

Test plan

• cargo test -p sandlock-core --test integration -- netlink_virt (10/10)
• cargo test -p sandlock-core --test integration -- network port_remap http_acl (27/27)