Merge branch 'wireguard-updates-for-6-16'

Jason A. Donenfeld says:

====================
wireguard updates for 6.16

This small series contains mostly cleanups and one new feature:

1) Kees' __nonstring annotation comes to wireguard.

2) Two selftest fixes, one to help with compilation on gcc 15, and one
   removing stale config options.

3) Adoption of NLA_POLICY_MASK.

4) Jordan has added the ability to run:

    # wg set ... peer ... allowed-ips -192.168.1.0/24

  Which will remove the allowed IP for that peer. Previously you had to
  replace all the IPs non-atomically, or move it to a dummy peer
  atomically, which wasn't very clean.
====================

Link: https://patch.msgid.link/20250521212707.1767879-1-Jason@zx2c4.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>