fix(vmm): enforce port mapping policy on update_vm

[kvinwang]

Problem

create_manifest_from_vm_config enforces cvm.port_mapping (enabled and range), but update_vm builds its port map without consulting it. CreateVm with no ports followed by UpdateVm { update_ports: true, ports: [...] } publishes any host port, even on a node with port mapping disabled (GHSA-hqm3-qmh8-5xx2).

The update path also parses an empty host_address instead of falling back to cvm.port_mapping.address, so a request shape valid at deploy time fails on update with "Invalid host address".

Fix

Both paths go through a shared port_map_from_proto. Mappings the VM already holds are exempt from the policy check: the web UI sends update_ports = true with the full current list on every update, so without the exemption narrowing the node's policy would block every other update to an affected VM. Deployment passes no held mappings.

Compat: updates that add a mapping outside the node's policy are now rejected; an omitted host_address on update is now accepted.

GPU part split into #1346 (merged).

Verification

cargo test -p dstack-vmm (211 passed), cargo clippy -p dstack-vmm --bins -- -D warnings, cargo fmt --check.