d/libn/i/nftables: reject Apply on a closed nft_ctx

Close() frees the libnftables context and nils out the handle, so passing
a closed nftCtx to Apply() would hand a nil pointer to libnftables and
crash the daemon.

No caller can do that today: table.nftApply() nil-checks its *nftCtx and
creates a new context when it has been closed, and RunCmd() owns its
context for the duration of a single call. Return an error anyway, rather
than depending on every future caller to get the lifecycle right.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Signed-off-by: Cory Snider <csnider@mirantis.com>

daemon/libnetwork/internal/nftables/nft_cgo_linux.go

@@ -35,6 +35,10 @@ type nftCtx struct {
 
 // Apply calls libnftables to execute the nftables commands in nftCmd.
 func (h *nftCtx) Apply(ctx context.Context, nftCmd []byte) error {
+	if h.handle == nil {
+		return errors.New("libnftables: context is closed")
+	}
+
 	ctx, span := otel.Tracer("").Start(ctx, spanPrefix+".nftApply.cgo")
 	defer span.End()