use more explicit netstack dependency restrictions

Fuchsia was unable to build when building netstack transitively depended on
golang.org/x/unix constants not defined in Fuchsia. The packages causing this
(safemem and usermem) are no longer in the allowlist.

Tested that this failed at cl/373651666, and passes now that the dependency has
been removed.

PiperOrigin-RevId: 374570220

pkg/tcpip/BUILD

@@ -39,12 +39,30 @@ go_library(
 deps_test(
     name = "netstack_deps_test",
     allowed = [
+        # gVisor deps.
+        "//pkg/atomicbitops",
+        "//pkg/buffer",
+        "//pkg/context",
+        "//pkg/gohacks",
+        "//pkg/goid",
+        "//pkg/ilist",
+        "//pkg/iovec",
+        "//pkg/linewriter",
+        "//pkg/log",
+        "//pkg/rand",
+        "//pkg/sleep",
+        "//pkg/state",
+        "//pkg/state/wire",
+        "//pkg/sync",
+        "//pkg/waiter",
+
+        # Other deps.
         "@com_github_google_btree//:go_default_library",
         "@org_golang_x_sys//unix:go_default_library",
         "@org_golang_x_time//rate:go_default_library",
     ],
     allowed_prefixes = [
-        "//",
+        "//pkg/tcpip",
         "@org_golang_x_sys//internal/unsafeheader",
     ],
     targets = [