Add global country IPv4 bypass settings

[M0-kii]

Adds an optional Settings → Routing page for bypassing the VPN for destination IPv4 ranges allocated to selected countries. For example, selecting IR sends matching IPv4 traffic through the normal internet gateway. The setting is global, off by default, and leaves existing .ovpn profiles unchanged.

The page provides a country checklist, a Search button accepting names or ISO codes, and an explicit update action that fetches aggregated CIDRs from IPdeny over HTTPS. Search cycles through matching names without changing checkboxes. Downloads are validated before replacing the local cache; connecting uses the offline cache.

The GUI merges the selected ranges and passes a temporary, routes-only configuration containing route ... net_gateway directives alongside the original profile. The temporary file is protected against modification while in use and cleaned up after failure or exit. Normal interactive-service authorization remains in place.

Scope

• OpenVPN 2 engine, IPv4, and one active GUI connection at a time. OpenVPN 3 mode is rejected when bypass is enabled.
• IPv6 and DNS keep their existing behavior. More specific profile/server routes and firewall policies can override or prevent bypass.
• Apply changes by disconnecting and connecting again; persistent service profiles and pre-logon connections are outside this setting.
• Country allocations are approximate, not authoritative geolocation. No IP database is bundled; updates are requested by the user.
• New UI strings currently use the English fallback.

Validation

• Built the x64 GUI and PLAP library with MSVC in RelWithDebInfo.
• All three CTest suites pass: strict CIDR parsing, 100 deterministic randomized comparisons against Python's ipaddress.collapse_addresses, and isolated native Windows UI/preferences/file-lifecycle tests. Search coverage includes ISO precedence, case-insensitive names, wraparound, whitespace, and preserving checkboxes.
• A live WinHTTP download validated 1,747 Iranian CIDRs.
• Formatting and whitespace checks pass.
• A live VPN tunnel has not yet been tested. The local standard Release build requires Spectre libraries that are not installed; upstream Release mitigation settings were left intact.

COUNTRY_ROUTING.rst documents data sources, behavior, limits, and manual tunnel verification.

[schwabe]

Apart from if this is really the right place to implement something like we do not really like features that are IPv4 only.