This adds a zone-based firewall configured using Nix and backed by
nftables. It is ideal for use on routers and servers, and useful for
any system with more than one network connection. At the time of this
commit, it has already been used in production on multiple machines
for several months.

Motivation for this change

The existing nix firewall is very rudimentary; it is only suitable for systems with a single interface, or for which all interfaces should be treated equally. Anything more complex needs to be handled via hand-written iptables scripts (which, admittedly, can be maintained using nix).

This new zone-based firewall allows declaratively adding rules that apply to any desired combination of zones (where a "zone" is some combination of interfaces or the local machine). Each rule has an attached priority, which allows the firewall rules for a given service to be kept next to the configuration for the service, while still being able to rely on some rules being evaluated before other rules.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

This PR is intended as a draft; it is still missing (and desperately needs) documentation and tests. I will write documentation in the coming weeks, but I'm not particularly sure how to test this module and could use some advice.

This started out being developed in thequux/nix-zone-firewall; the README there is a decent starting point for seeing how to use it, but it hasn't been updated for significant configuration changes in the last commit of that repo.