Add unit tests for netbox and sonic command modules

[berendt]

Summary

Implements #2366: unit tests for the two network-facing CLI command modules osism/commands/netbox.py and osism/commands/sonic.py.

• tests/unit/commands/test_netbox.py (extended): Sync._check_netbox_instance / _check_netbox_connectivity error classification (timeout, auth, connection refused, SSL, truncation, missing http_session), _build_netbox_table (primary/secondary rows, getattr fallbacks, connectivity column), the --list / --check / --no-wait / --filter paths of Sync.take_action, argument assembly in Ironic and Manage, Versions, the nbcli bootstrap and argument quoting in Console, and the device lookup fallback chain, YAML custom-field formatting and field filter of Dump.
• tests/unit/commands/test_sonic.py (new): SonicCommandBase helpers (_get_device_from_netbox, _get_config_context, _save_config_context, _get_ssh_connection_details, _generate_backup_filename, the six exec-command helpers, _cleanup_temp_file, _get_ztp_status) and the take_action control flow of Load, Backup, Ztp, Reload, Reboot, Reset, Show, Console, and Dump (step ordering, per-step failure exit codes, paramiko exception handling, ssh.close() in finally).
• tests/unit/commands/test_sonic_validate.py (new): Validate._collect_sources (all four sources, hostname requirements), _configs_from_export_dir (prefix/suffix matching, hostname filter, invalid JSON), _config_from_netbox, _config_from_generate (HWSKU validation, config_version), the take_action exit-code contract (0/1/2, JSON payload), _print_text_report formatting, and List (provision-state derivation, sorting, N/A fallbacks, task failure).

No duplication of the existing coverage in test_sonic_ssh.py (--refresh-host-key wiring, _create_ssh_connection) or of the pre-existing exit-code tests.

Bug fix

Writing the tests surfaced that the except requests.exceptions.SSLError branch in Sync._check_netbox_connectivity was unreachable: SSLError is a subclass of ConnectionError in requests, so SSL failures in the reachability stage were reported as Error: Connection refused. The first commit reorders the except clauses so certificate problems are reported as Error: SSL error, as the issue's expected behavior describes.

Closes #2366

[ideaship]

This asserts take_action() == 0 when _reload_configuration() returned False. That locks in a real bug in Reload.take_action (osism/commands/sonic.py:654-677): on reload failure it logs "Skipping config save due to reload failure", skips the save, then logs "SONiC configuration reload completed successfully" and returns 0 — so automation gets a success exit code after the device-side sudo config reload -y actually failed. Note the asymmetry: the _load_configuration failure just above returns 1, so load-failure exits 1 but reload-failure exits 0, on the very operation the command is named for.

Please make production return 1 on reload failure and change this assertion to == 1 (keep _save_configuration.assert_not_called() and the log-message check). The production change should be a separate commit from the test change — mirroring how the stage-1 SSL reorder shipped on its own — but it must land in this PR, since this test must not merge asserting == 0.

[ideaship]

These SSL cases use clean strings ("certificate verify failed", "SSL handshake failed") that contain no "connection" substring, so they never exercise the branch ordering in _check_netbox_instance (osism/commands/netbox.py:201-204), which tests "connection" before "ssl"/"certificate". A realistic requests SSL failure surfaced through nb.status() stringifies as HTTPSConnectionPool(host='...', port=443): Max retries exceeded ... (Caused by SSLError(...)) — that contains "connection", so it would be misclassified as "Error: Connection refused". This is the same SSL-before-connection priority the stage-1 reachability check just fixed, still latent here in the string-based classifier used for secondary instances.

Please add a case like ("HTTPSConnectionPool(host='nb', port=443): Max retries exceeded (Caused by SSLError(...))", "Error: SSL error"). It will fail against the current ordering. The production ordering fix — moving the "ssl"/"certificate" check above the "connection" check — is being tracked as a separate PR, so either land both together (production fix in its own commit) or keep this case pending on that fix.