icmp_reflect reflects source-route/RR/TS IP options into echo reply: info leak + source-route revival

Summary

icmp_reflect(:1025-1085): when optlen>0 retrieves ip_srcroute(m)+bcopy IPOPT_RR/IPOPT_TS/IPOPT_SECURITY options from incoming into reply options mbuf. Accumulation loop has correct bounds checks (no memory-safety bug). BUT echoing LSRR/SSRR/RR/TS into reflected replies -> traffic amplification, route mapping/topology info leak, source-route revival when accept_sourceroute enabled (non-default). Options space <=40 bytes fits MHLEN. Fix: drop LSRR/SSRR from copy set, retain RR/TS for diagnostics.