add CBG++ geolocation pipeline

[grace71]

Summary

• Add cbg/: a CBG++ pipeline that
  retrieves RIPE Atlas anchors, derives per-anchor latency-distance
  calibrations, and produces a geolocation region for a target host
  along with the country/countries it intersects.
• Add run_vpn_validator (utilities/experiments.py): spins up a
  dedicated incus instance, prepares anchor + calibration data on the
  host (cached for 7 days), then iterates every configured OpenVPN
  provider/location/config — collecting pings from inside the VM and
  producing both raw CBG results and a comparison against MaxMind /
  Team Cymru / Cloudflare metadata.
• Add vpn_validator into utilities/experiment_mapping.py.
• Two small utility helpers used by the validator:
  • utilities/http_utils.get_instance_ip — queries the VM's egress IP
    via the same ip_resolvers list used by get_curr_ip.
  • utilities/incus_helper.push_file — counterpart to the existing
    pull_file.