fix(upnp): panic with "mapping should exist"

closes #6377

This PR splits the `mappings` field into `mappings`, `add_requests`, and `remove_requests` to manage port mappings and in-flight request tracking in separate data structures.

The `network_interface_change` and `listener_with_multiple_addresses` tests added in this PR reproduce the issue described in #6377, and both now pass after the fix.

Pull-Request: #6459.

Author: ackintosh

protocols/upnp/CHANGELOG.md

@@ -3,6 +3,10 @@
 - Raise MSRV to 1.88.0.
   See [PR 6273](https://github.com/libp2p/rust-libp2p/pull/6273).
 
+- Fix panic with "mapping should exist" caused by conflating port-level mapping state
+  with per-request in-flight tracking under a single `listener_id` key.
+  See [PR 6459](https://github.com/libp2p/rust-libp2p/pull/6459)
+
 ## 0.6.0
 
 - Change `Event::NewExternalAddr` and `Event::ExpiredExternalAddr` from tuple variants to struct variants