feat(networking): add leaf subject filtering and port networking Go tests (D6+D7)

D6: Add ExportSubjects/ImportSubjects allow-lists to LeafHubSpokeMapper alongside
existing DenyExports/DenyImports deny-lists. When an allow-list is non-empty, subjects
must match at least one allow pattern; deny always takes precedence. Updated
LeafNodeOptions, LeafHubSpokeMapper (5-arg constructor), and LeafNodeManager to wire
through the new allow-lists. Added 13 new unit + integration tests covering allow-list
semantics, deny precedence, bidirectional filtering, and wire-level propagation.

D7: Existing NetworkingGoParityTests.cs (50 tests) covers gateway interest mode,
route pool accounting, and leaf node connections. Parity DB already up to date.

src/NATS.Server/LeafNodes/LeafNodeManager.cs

@@ -59,7 +59,9 @@ public sealed class LeafNodeManager : IAsyncDisposable
         _subjectFilter = new LeafHubSpokeMapper(
             new Dictionary<string, string>(),
             options.DenyExports,
-            options.DenyImports);
+            options.DenyImports,
+            options.ExportSubjects,
+            options.ImportSubjects);
     }
 
     public Task StartAsync(CancellationToken ct)