trap: deliver reserved multicast to the CPU by trap, STP first

A reserved-multicast trap goes to the port named in EXT_CPU_CTRL, which
names no port out of reset, so trapped frames were dropped at ingress.
trap_init() points it at the CPU port once at startup, and
trap_rma_set() changes only the action field of an RMA register.

A trapped frame arrives without the VLAN tag a forwarded one gets, so
TRAP_RX_BODY() gives the offset of the payload for both forms.

STP now traps its address while it runs instead of steering it with a
static L2 entry per VLAN, so turning it on no longer walks the VLAN
table and a pvid change no longer needs stp off and on. With STP off
the flooding entries are restored as before.

A trapped BPDU passes the tagged-only ingress filter that drops a
forwarded one, so the stp_setup() warning about such ports goes.

Makefile

@@ -89,7 +89,8 @@ SRCS += \
 	rtl837x_port.c \
 	rtl837x_stp.c \
 	rtl837x_lldp.c \
-	rtl837x_storm.c
+	rtl837x_storm.c \
+	rtl837x_trap.c
 SRCS += \
 	httpd/httpd.c \
 	httpd/page_impl.c