[DONT MERGE] Test VPP worker reduction and ACL IN_PORTS

[lolyu]

Why I did it

Do not merge. This PR exists only to produce a test image; it will not be merged.

It carries two independent VPP changes that both need validation on a built image:

PR	Change
sonic-net/sonic-platform-vpp#282	Reduce the syncd-vpp dataplane from 2 workers to 1, with a VPP_WORKERS override
sonic-net/sonic-sairedis#2064	Fan a scoped SAI ACL entry out into one VPP rule per named port, so SAI_ACL_ENTRY_ATTR_FIELD_IN_PORTS is honoured

#282 matters because every VPP worker busy-polls a full core whether or not traffic is
flowing: vlib/file.c skips the epoll sleep while any input node is polling, and the
poll-sleep-usec throttle is is_main-guarded so it can never apply to a worker. With
virtio (1af4:1041) supporting neither interrupt nor adaptive rx-mode, the worker count is
the only available lever. Dropping 2 to 1 measured 282% to 178% VPP CPU per DUT and took the
host run queue from 11 to 7.

#2064 matters because saivpp previously accepted the IN_PORTS qualifier, reported
success, then discarded the scope — so an entry meant to drop on one port dropped on every
port the table was bound to.

The two changes are unrelated and touch disjoint code; they share an image only because both
need the same VPP testbed to validate.

Work item tracking

• Microsoft ADO (number only):

How I did it

Repointed two submodules at the PR branches:

platform/vpp       -> lolyu/sonic-platform-vpp @ adjust_vpp_workers    (fecb772)
src/sonic-sairedis -> lolyu/sonic-sairedis     @ vpp_acl_in_port_match (fba649b)

src/sonic-swss is deliberately left on upstream master. Both branches are behind=0
relative to their upstreams, so this image is master plus exactly the two changes above.

How to verify it

Build the VPP image and deploy to a KVM testbed.

Worker count — expect one vpp_wk_* thread, not two:

$ docker exec syncd vppctl show threads
ID     Name         Type      LWP    lcore  Core  Socket
0      vpp_main               56     2      2     0
1      vpp_wk_0     workers   63     1      1     0

The override still works, and 0 is accepted as main-thread forwarding:

# unset            -> workers 1   (new default)
# VPP_WORKERS=0    -> workers 0   (forwarding on vpp_main, no worker thread)
# VPP_WORKERS=3    -> workers 3
# VPP_WORKERS=bogus -> rejected at init with a clear error

ACL IN_PORTS — a scoped entry should install one VPP rule per named port, and a standby
mux port should not drop traffic on unrelated ports:

$ docker exec syncd vppctl show acl-plugin acl

Test suites to run on a dualtor-aa-vpp testbed:

• dualtor_io/test_normal_op.py
• acl/test_acl.py
• drop_packets/test_drop_counters.py

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[mssonicbld]

/azp run Azure.sonic-buildimage

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[mssonicbld]

/azp run Azure.sonic-buildimage

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).