[sai_test] Add opt-in port and BFD notification test cases

[nicholasching]

Context / motivation
Part of the SAIVPP unit-test framework. sai_test currently has no coverage for asynchronous SAI notifications: nothing exercises SAI_SWITCH_ATTR_PORT_STATE_CHANGE_NOTIFY or SAI_SWITCH_ATTR_BFD_SESSION_STATE_CHANGE_NOTIFY. This adds the first tests for that path, using the saithrift notification RPCs added separately.

What this change does

• test/sai_test/sai_notification_test.py. New module with five classes: PortStateChangeTest, PortStateRecoveryTest, BfdSessionUpTest, BfdSessionDownTest and BfdMultihopTest.
• Opt-in. Every class skips unless the harness passes the vpp_notification_test PTF parameter; the BFD classes additionally require SIMULATE_SONIC=1. With neither set the module is inert.
• Port cases. Flap the SAI host-interface netdev and wait for the matching port OID and oper status, polling every 0.5s within a 5s budget. The wire-side veth peer is deliberately not used: VPP binds it with an AF_PACKET socket whose driver does not watch the underlying netdev carrier, so Linux reports NO-CARRIER while vppctl show hardware-interfaces still reports the link up and no interface event is ever raised.
• BFD cases. Anchor the session on a LAG router interface that already has a connected local address, create the peer neighbor so the dataplane can build the L2 header, and drive the far end with a small scapy responder. The responder follows the RFC 5880 state machine (a peer in Down only leaves that state on receiving Down or Init), targets UDP 3784/4784 in both directions with an ephemeral source port, and listens on every LAG member because the flow is hashed onto one of them.
• Independent corroboration. Assertions are checked against vppctl output rather than only re-reading the SAI attribute that the notification path itself writes. All SAI objects and link state are restored in finally/tearDown.

Scope / risk

• One new file. No existing test, helper, SAI header, or backend code is modified.
• Default-off by construction, so other consumers (real ASICs, other harnesses) are unaffected.
• BFD waits use a longer timeout than the port cases: RFC 5880 holds the control-packet interval at one second until a session is up, and measured bring-up against the responder is around 5.5s.
• Validated behavior: on a VPP bench all five classes passed three consecutive module runs, plus a full five-module 90-selector matrix run at PORT_COUNT=32 with per-test isolation, which reported 90 observed selectors and zero regressions against the existing stable baseline.

Dependencies
Requires the saithrift notification bridge PR, #2335. The two touch disjoint files and can merge in either order, but these tests are non-functional until the RPCs exist.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[nicholasching]

Hi @kcudnik @tjchadaga, when you have a chance, could you please invoke azure pipelines to run checks. Thanks!