trap: deliver reserved multicast to the CPU by trap, STP first

A reserved-multicast trap goes to the port named in EXT_CPU_CTRL, which
names no port out of reset, so trapped frames were dropped at ingress.
trap_init() points it at the CPU port once at startup, and
trap_rma_set() changes only the action field of an RMA register.

A trapped frame arrives without the VLAN tag a forwarded one gets, so
TRAP_RX_BODY() gives the offset of the payload for both forms.

STP now traps its address while it runs instead of steering it with a
static L2 entry per VLAN, so turning it on no longer walks the VLAN
table and a pvid change no longer needs stp off and on. With STP off
the flooding entries are restored as before.

A trapped BPDU passes the tagged-only ingress filter that drops a
forwarded one, so the stp_setup() warning about such ports goes.

doc/l2.md

@@ -73,13 +73,14 @@ without being flooded to the other ports. No bridge relays these frames:
 their addresses are in the set that 802.1D-2004 clause 7.12.6 forbids a
 bridge to forward, and what travels the network is the information, with
 every bridge regenerating BPDUs of its own on its designated ports. The reserved-multicast *trap* action
-cannot do that on this hardware, because its destination is an external CPU
-attached to a physical port, which these boards do not populate. The protocol
-modules therefore leave the reserved-multicast action at *forward* and constrain
-the egress with a static L2 multicast entry instead: the lookup hits the entry's
-own port mask rather than the VLAN flood mask. Verified on a SWTGW218AS both
-ways, with the CPU bit cleared, where delivery stops, and with the CPU bit alone,
-where nothing egresses.
+does that: it delivers to the port named in `EXT_CPU_CTRL` (0x6724), which
+`trap_init()` sets to 9, the CPU port, at startup; with the reset value 0xf it
+names no port and the trapped frame is dropped. STP traps its address while it
+runs (see stp.md). Where the action is left at *forward*, the egress can be
+constrained with a static L2 multicast entry instead: the lookup hits the
+entry's own port mask rather than the VLAN flood mask. Verified on a SWTGW218AS
+both ways, with the CPU bit cleared, where delivery stops, and with the CPU bit
+alone, where nothing egresses.
 
 `port_l2mc_set()` writes one such entry. The SMI layout is the L2 multicast
 variant of the table entry: