refactor the reading of /sys/class/net

lo is just a convention as an interface that has no address, a determined
admin may even rename it to `loopback` or `colin` so instead test that we
return the first address that isn't `00:00:00:00:00:00`

Also refactors the spec test to allow this