refactor: convert IP addresses to text without allocating

[sbogomolov]

IpAddress's formatter went through ToString, allocating a string per formatted address — including IPv4, which sized its buffer to 16 and stepped just past libstdc++'s small-string capacity. ToChars writes into a caller-provided buffer and returns a view of it; ToString stays for the one caller that needs an owning string.

Nine raw_socket log sites passed ToString into a formatter that already handles IpAddress, so they pass the address itself now — the rest of the codebase, including the test util, already did. Behaviour note: IPv6 prints bracketed in those nine lines as a result ([ff02::c]), matching every other site.

MacAddress needed no change — it has no ToString and its formatter always wrote straight to the output iterator.

Enforcing it

Three changes now rest on formatting staying off the heap, with nothing checking it. ScopedAllocationCounter counts allocations via the sanitizer's malloc hooks. Two earlier designs were discarded for concrete reasons worth recording:

• replacing global operator new collided with ASan's own nothrow/aligned overloads (alloc-dealloc-mismatch, whole suite down);
• watching __sanitizer_get_current_allocated_bytes is a net figure, so a string built and freed inside the window reads as zero — it passed with the regression deliberately reinstated.

The hook version catches it: 1 allocation with ToString restored in the formatter, 0 with ToChars. It needs a long IPv6 literal, since ff02::c fits libc++'s SSO and never allocated either way.

Sanitizer-gated, so the test is #if-guarded to match.

Native (893), docker Debug (880) and docker Release (879, test correctly excluded) all green.