Add an initial implementation of per-protocol-layer sandboxing.

The infstructure for sandbox creation is there, but the sandboxes are
just invoked at the top level so all processing occurs in the last one.
Dispatch calls to ip_print to the next sandbox if any are available.
Rework the ip_print invocation code to avoid knowledge of CHERI in
print-ip.c.  Use function pointers as tokens in an evil hack to avoid
exposing sandbox implementation details within tcpdump.
Whitespace fixes
Rename DISSECTOR_DECLARE to ND_DECLARE.
Add a second packetbuf_t argument to invoke_dissector.
Add a dispatchable tcp printer.