fix(upnp): panic with "mapping should exist"

[ackintosh]

Description

closes #6377

This PR splits the mappings field into mappings, add_requests, and remove_requests to manage port mappings and in-flight request tracking in separate data structures.

The network_interface_change and listener_with_multiple_addresses tests added in this PR reproduce the issue described in #6377, and both now pass after the fix.

AI Assistance Disclosure

Tools used (required — write none if no AI was used): Claude Code

Attestation (required):

• I have read every line of this diff, understand what it does, and can explain it in review.

Notes & open questions

#6459 (comment)

Change checklist

• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• I have added tests that prove my fix is effective or that my feature works
• A changelog entry has been made in the appropriate crates