NSX: configure segment discovery and security profiles

[Dogface2k]

Summary

• expose optional IP discovery, MAC discovery, and segment security profiles on NSX network offerings;
• validate that referenced profiles resolve to the requested canonical resource and are not marked for deletion;
• bind selected profiles in the same hierarchical NSX request as segment creation;
• reject profile changes on existing networks instead of silently reconfiguring an active segment;
• add focused API, NSX client, resource, guru, and configuration coverage.

When no profiles are configured, segment creation keeps the existing behavior. This change is limited to NSX segment profile configuration; DHCP/IPAM and Kubernetes load-balancer rule regeneration are not part of this PR.

Validation

The branch is based on CloudStack main at 4f117071c9. The focused source and unit tests are included in the branch. The PR remains a draft pending the 4.23 NSX/CKS E2E validation on the target installation.

need to review these from NsxApiClientTest:

• Sessions
• SegmentDiscoveryProfileBindingMaps
• SegmentSecurityProfileBindingMaps
• StaticRoutesListResult
• Tag
• Tier1
• TunnelInterfaceIPSubnet

None of these classes is referenced by the test class.

TODO: add the real missing-profile failure path to NsxApiClientTest.

Mock IpDiscoveryProfiles.get("ip-profile") to throw NotFound, assert that createSegment() returns a clean CloudRuntimeException, and verify that neither Segments.patch() nor Infra.patch() is called.

The existing tests cover a returned profile with a bad path, a different ID, and markedForDelete=true, but they do not cover the actual NSX 404/NotFound response for an absent profile.