ip.bind: bind outbound connections to the configured address (#9834)

* ip.bind: bind outbound connections to the configured address

-ip.bind only governed listeners; outbound gRPC and HTTP connections let
the OS pick the source IP, which may not even be able to reach the
target. Mirror the bind address into a process-global source address and
apply it to outbound TCP dials: the gRPC context dialer, the per-client
HTTP transports, and the default transport. Loopback targets and unix
sockets keep the OS-chosen source so same-host traffic still works.

* ip.bind: first-write-wins source IP, skip on address-family mismatch

Make SetOutboundLocalIP first-write-wins so a `weed server` component's own
bind setting (run in its goroutine) can't clobber the process-wide source
address the top-level -ip.bind already established for the other components.

Skip source binding when the target is a literal IP of a different family
than the bind address, since forcing a mismatched source fails the dial.

weed/util/http/client/http_client.go

@@ -165,6 +165,8 @@ func NewHttpClient(clientName ClientName, opts ...HttpClientOpt) (*HTTPClient, e
 		MaxIdleConns:        1024,
 		MaxIdleConnsPerHost: 1024,
 		TLSClientConfig:     tlsConfig,
+		// Bind outbound HTTP to the -ip.bind source address.
+		DialContext: util.OutboundDialContext,
 	}
 	httpClient.Client = &http.Client{
 		Transport: httpClient.Transport,
@@ -279,6 +281,8 @@ func NewHttpClientWithTLS(certFile, keyFile, caFile string, insecureSkipVerify b
 		MaxIdleConns:        1024,
 		MaxIdleConnsPerHost: 1024,
 		TLSClientConfig:     tlsConfig,
+		// Bind outbound HTTP to the -ip.bind source address.
+		DialContext: util.OutboundDialContext,
 	}
 	httpClient.Client = &http.Client{
 		Transport: httpClient.Transport,