OVS: validate distributed VPC topology updates

[Dogface2k]

Summary

• keep OVS distributed-router topology updates scoped to VPCs whose connectivity provider is OVS;
• reject malformed VPC network topology data with actionable validation errors;
• contain topology callback failures so one malformed or unavailable VPC does not abort updates for other VPCs;
• add focused unit coverage for provider ownership, broadcast-key validation, missing gateway NICs, and callback failure handling.

Validation

The change is isolated from the NSX, VPN, CKS, and UI feature work. The focused OVS tests are included in this branch and the full 4.23 build has already compiled the corresponding source tree. Draft status is intentional pending the repository CI run / e2e

TODO: do not narrow the GRE key from long to signed int.

Keep greKey as long, parse it with Long.parseLong(), and explicitly validate it as a positive unsigned 32-bit GRE value. Integer.parseInt() rejects values from 2147483648 through 4294967295, even though GRE has a 32-bit key. OvsVpcPhysicalTopologyConfigCommand.Tier already stores greKey as long.

The test that currently expects 2147483648 to be rejected should be changed accordingly.

TODO: move isOvsDistributedRouterVpc(vpcId) inside the per-VPC try/catch.

The provider/VPC lookup currently happens before the catch, so an exception from that lookup can still abort processing of every later VPC, contrary to the failure-isolation goal of this PR.

Add a test where the first VPC's provider lookup throws and a second valid OVS distributed VPC still reaches topology generation or sending. The existing continuation tests only make the second VPC non-OVS and verify that it was inspected.