multiport: fix panic sending to IPv6 remotes over the raw socket

RawConn builds IPv4 headers only, but WriteTo called As4() on every destination. Once a handshake passed tun.multiport.tx_handshake_delay, the handshake manager sent a multiport copy to every remote, and the first IPv6 address panicked with "As4 called on IPv6 address". The tunnel send path in inside.go had the same problem for any multiport tunnel with an IPv6 remote.

Add udp.RawSupported and only use the raw socket for IPv4 (and IPv4-mapped) destinations; IPv6 remotes fall back to the normal UDP writer. RawConn.WriteTo now returns an error rather than panicking, matching ErrInvalidIPv6RemoteForSocket on the regular UDP sockets.

Seen in production on v1.11.1-slack1: https://slack-pde.slack.com/archives/GK7NPNGPP/p1792590741819449

Co-Authored-By: Claude <svc-devxp-claude@slack-corp.com>

inside.go

@@ -414,7 +414,7 @@ func (f *Interface) sendNoMetrics(t header.MessageType, st header.MessageSubType
 	}
 
 	if remote.IsValid() {
-		if multiport {
+		if multiport && udp.RawSupported(remote) {
 			rawOut = rawOut[:len(out)+udp.RawOverhead]
 			port := udpPortGetter.UDPSendPort(f.multiPort.TxPorts)
 			err = f.udpRaw.WriteTo(rawOut, port, remote)
@@ -428,7 +428,7 @@ func (f *Interface) sendNoMetrics(t header.MessageType, st header.MessageSubType
 			)
 		}
 	} else if hr := hostinfo.GetRemote(); hr.IsValid() {
-		if multiport {
+		if multiport && udp.RawSupported(hr) {
 			rawOut = rawOut[:len(out)+udp.RawOverhead]
 			port := udpPortGetter.UDPSendPort(f.multiPort.TxPorts)
 			err = f.udpRaw.WriteTo(rawOut, port, hr)