security: Round 6.4 socket copy_to_user SMAP compliance (K35)

security: Round 6.4 socket copy_to_user SMAP compliance (K35)

K35: Add bounce buffers to sendmsg/recvmsg for SMAP compliance
- sendmsg: copy_from_user to kernel buffer before ksocket_send/ksocket_sendto
- recvmsg: ksocket_recvfrom to kernel buffer, then copy_to_user to user buffer
- Bounce buffer size limited to 4096 bytes per iov entry
- Ensures SMAP compliance by not passing user buffers directly to lwIP

Tests: 119/119 PASS (smoke test, SMP=4)