When a PJSIP endpoint does not explicitly set `transport`, the RTP
socket binds to `[::]` (or `0.0.0.0`) instead of the transport's bind
address. This is because `create_rtp()` only resolves the transport
via a sorcery lookup on `session->endpoint->transport`, which is empty
when the transport is auto-selected.

On a multi-homed host or NAT gateway whose transport binds to a
specific interface, the wildcard-bound RTP socket causes the kernel to
select a source IP that may conflict with conntrack DNAT entries for
inbound RTP, causing MASQUERADE to silently remap the RTP source port.
The remote end receives RTP from an unexpected port and drops it,
resulting in one-way audio with no errors logged by Asterisk.

When no explicit transport is configured and ICE is not in use,
determine the transport type from the dialog's target URI and acquire
the transport via `pjsip_tpmgr_acquire_transport()`. If the
transport's bind address is a specific (non-wildcard) address, use it
for RTP. When the transport binds to a wildcard address (0.0.0.0 or
[::]), the RTP socket is left on the wildcard as well, matching the
behaviour of the explicit-transport code path and preserving
dual-stack operation.

When ICE is enabled the wildcard bind is left as-is since ICE needs
to discover candidates on all interfaces.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

UserNote: When a PJSIP endpoint does not have an explicit `transport`
configured, ICE is disabled, and the auto-selected transport binds to
a specific (non-wildcard) address, the RTP socket now binds to that
address instead of the wildcard. This fixes one-way audio on
multi-homed hosts and NAT gateways where the wildcard bind caused the
kernel to select an incorrect source address for outbound RTP.

Fixes: asterisk#1847