try do a better job of filtering 802.1 reserved group addresses.

try do a better job of filtering 802.1 reserved group addresses.

if the bridge is supposed to carry vlan packets, assuming it's an
s-vlan component and should allow certain group addresses to cross
between "customer" bridges.

i should probably let some of these groups fall back through to the
calling ether_input rather than drop them.