feat(mirror): add incoming port_mapping for mirrord

What does this merge request do and why?

When several Caproni instances run edit mode on one host, mirrord delivers stolen pod traffic to the same local port for each, so the local processes collide. This adds mirror.network.incoming.port_mapping, a list of local:remote strings, like Docker's host:container, validated by the schema and by a port range check, then rendered into the mirrord config. Each instance can then listen on its own local ports. The process itself must listen on the local port, for example through its own config or an env entry it reads.

How to set up and validate locally

1. Add network.incoming.port_mapping: [18080:8080] to a mirror reloader in caproni.yaml.
2. Run caproni run and check the generated mirrord config has feature.network.incoming.port_mapping.

Agent context

• MirrorIncomingConfig.PortMapping is []string; PortPairs() parses it into mirrord's [local, remote] int pairs (IncomingConfig.PortMapping stays [][]int). No int-pair form is accepted.
• Schema: array of strings matching ^[0-9]+:[0-9]+$, unique items. The 1-65535 range is checked in ValidateSemantics (error names the reloader and field) and again when generating the mirrord config.
• Unquoted 18080:8080 decodes as a string with yaml.v3; covered by a test.
• Docs updated in docs/config/_index.md.
• A rendered config passes mirrord verify-config (mirrord 3.265.0).