feat: HostFirewallMixin, a Linux host's own netfilter rules (NetOrk/netork#1344)

get_host_firewall() reads `nft -j list ruleset` as root and returns every
chain with its family, table, hook, priority and policy, and every rule as
matches and a verdict. Rules iptables-nft wrote show their extensions in nft's
JSON only as an opaque `xt`, so the tables iptables manages are taken from
iptables-save instead; a legacy iptables is kept beside nft's tables, since
both apply. A condition the parse does not model is an `unknown` match with
its text, never left out. Without root neither tool can be read, and
HostFirewallUnavailable is raised rather than a host without rules.

A driver supplies only _run_host_firewall_command(command, privileged=).
Version 4.21.0.

README.md

@@ -150,6 +150,17 @@ without `ss` is read with `netstat -lntup` (OpenWrt's busybox, old net-tools); o
 cgroup names the procd service (`/services/<name>/<instance>`). A host with neither raises
 `ListeningSocketsUnavailable`.
 
+`HostFirewallMixin` (`get_host_firewall`) reads a Linux host's own netfilter rules the same
+way: `nft -j list ruleset`, with the tables iptables-nft manages taken from `iptables-save`
+instead, because nft shows their extensions (`-m conntrack`, `-m set`) only as an opaque `xt`.
+A legacy iptables is a ruleset of its own and is kept beside nft's. Every chain says its family,
+table, hook, priority and policy; every rule is a list of matches (`iifname`, `saddr`, `dport`,
+`ct_state`, ...) and a verdict. A condition it does not model is an `unknown` match with its
+text, never left out. A driver supplies `_run_host_firewall_command(command, privileged=)`; both
+tools need root, so a host where neither could be read raises `HostFirewallUnavailable` rather
+than reading as one without rules. Whether the rules keep a service unreachable is the
+consumer's call.
+
 `VirtualIpsMixin` (`get_virtual_ips`) reads the addresses a host's HA configuration lets
 float between machines: vip-manager (5.x's `--config` YAML, 1.x's `-ip=${VIP_IP}` resolved
 through the unit's environment) and keepalived (`virtual_ipaddress` of every