Limit size of the search range for VNIs when creating VPCs

- Fixes #4283.
- Adds a relatively small limit to the `NextItem` query used for
  finding a free VNI during VPC creation. This limits the memory
  consumption to something very reasonable, but is big enough that we
  should be extremely unlikely to find _no_ available VNIs in the range.
- Add an application-level retry loop when inserting _customer_ VPCs,
  which catches the unlikely event that there really are no VNIs
  available, and retries a few times.
- Adds tests for the computation of the limited search range.
- Adds tests for the actual exhaustion-detection and retry behavior.

nexus/db-model/src/vpc.rs

@@ -110,6 +110,14 @@ impl IncompleteVpc {
             subnet_gen: Generation::new(),
         })
     }
+
+    /// Create a copy of self, but with a new random VNI.
+    ///
+    /// This is used to retry insertion of a VPC in the case where we can't find
+    /// an available VNI.
+    pub fn with_new_vni(self) -> Self {
+        Self { vni: Vni(external::Vni::random()), ..self }
+    }
 }
 
 impl DatastoreCollectionConfig<VpcFirewallRule> for Vpc {