ice: Allow VSI loopback in VEB mode

The embedded switch installs local forwarding rules with loopback enabled,
but their source VSI must also permit loopback. Without that permission,
traffic between host-attached VFs can trigger Tx data MDD events instead
of reaching the destination VSI.

Set ICE_AQ_VSI_SW_FLAG_ALLOW_LB when initializing a VSI in VEB mode, matching
the forwarding rules to the VSI permission. Keep MAC anti-spoof checking
enabled.

Validated on E810 with native iavf and DPDK VFs, together with the absolute
VF number correction. Local forwarding and queue/reset recovery passed;
spoofed source MACs were still rejected and isolated.

Fixes:          bc761988b7 ("ice: Add host SR-IOV support")
MFC after:      2 weeks
Sponsored by:   BBOX.io

sys/dev/ice/ice_lib.c

@@ -783,6 +783,9 @@ ice_initialize_vsi(struct ice_vsi *vsi)
 	}
 
 	ice_set_default_vsi_ctx(&ctx);
+	/* Match VSI loopback permission to the switch forwarding mode. */
+	if (hw->evb_veb)
+		ctx.info.sw_flags |= ICE_AQ_VSI_SW_FLAG_ALLOW_LB;
 	ice_set_rss_vsi_ctx(&ctx, vsi->type);
 
 	/* XXX: VSIs of other types may need different port info? */