Use opctx_alloc in start saga to query boundary switches

Finding boundary switches requires fleet access; use the special instance-
allocation context to do this (this context was already used for sled lookups
earlier in the relevant saga step).

This wasn't previously a problem because the instance create saga was
responsible for configuring NAT configuration, and it received a boundary switch
list as a saga parameter, which list was also provided by querying using the
instance allocation context.

nexus/src/app/sagas/instance_start.rs

@@ -323,16 +323,20 @@ async fn sis_dpd_ensure(
     );
     let datastore = osagactx.datastore();
 
+    // Querying sleds requires fleet access; use the instance allocator context
+    // for this.
     let sled_uuid = sagactx.lookup::<Uuid>("sled_id")?;
     let (.., sled) = LookupPath::new(&osagactx.nexus().opctx_alloc, &datastore)
         .sled_id(sled_uuid)
         .fetch()
         .await
         .map_err(ActionError::action_failed)?;
 
+    // Querying boundary switches also requires fleet access and the use of the
+    // instance allocator context.
     let boundary_switches = osagactx
         .nexus()
-        .boundary_switches(&opctx)
+        .boundary_switches(&osagactx.nexus().opctx_alloc)
         .await
         .map_err(ActionError::action_failed)?;