Add bwrap network namespace isolation to scripts with listening ports

[julek-wolfssl]

Add NETWORK_UNSHARE_HELPER/bwrap wrapping to benchmark.test,
openssl_srtp.test, and sniffer-gen.sh to isolate network namespaces and
prevent port collisions when tests run concurrently. sniffer-gen.sh uses
--cap-add ALL (like dtls.test) since it runs tcpdump. ocsp-stapling.test
is excluded because it connects to external servers (login.live.com).

[Copilot]

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds network namespace isolation to select test/scripts to avoid TCP/UDP port collisions when running concurrently, using either NETWORK_UNSHARE_HELPER or bubblewrap (bwrap).

Changes:

• Wrap sniffer-gen.sh, openssl_srtp.test, and benchmark.test with network-namespace unsharing logic.
• Use bwrap --unshare-net as a fallback when NETWORK_UNSHARE_HELPER is not provided.
• Grant additional capabilities for sniffer-gen.sh to support tcpdump.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 4 comments.

File	Description
scripts/sniffer-gen.sh	Adds wrapper to unshare network namespace (helper or bwrap), with elevated caps for packet capture.
scripts/openssl_srtp.test	Adds wrapper to unshare network namespace (helper or bwrap) before running the test.
scripts/benchmark.test	Adds wrapper to unshare network namespace (helper or bwrap) before running the benchmark.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.