feat: get_host_firewall, the host's own netfilter rules (NetOrk/netork#1344)

Mixes in napalm-device-types' HostFirewallMixin. The transport runs the shared
read-only command as root on an exec channel: nft prints the whole ruleset as
one line of JSON, longer than the PTY takes reliably, and both nft and
iptables-save need CAP_NET_ADMIN. Requires napalm-device-types 4.21.0;
version 0.13.0.

napalm_linux/linux.py

@@ -40,6 +40,7 @@ from napalm_device_types import (
     ContainerEngineMixin,
     EnsurePackageMixin,
     FingerprintRule,
+    HostFirewallMixin,
     HostStatusMixin,
     KernelFactsMixin,
     ListeningSocketsMixin,
@@ -297,6 +298,7 @@ class LinuxDriver(
     KernelFactsMixin,
     ServicePackagesMixin,
     ListeningSocketsMixin,
+    HostFirewallMixin,
     VirtualIpsMixin,
     ServiceClustersMixin,
     SystemIdentityMixin,
@@ -1188,6 +1190,15 @@ class LinuxDriver(
             return self._run_privileged(command, 60)
         return self._send(command, read_timeout=60)
 
+    def _run_host_firewall_command(self, command: str, *, privileged: bool) -> str:
+        """The transport for ``HostFirewallMixin.get_host_firewall``: an exec channel.
+
+        ``nft -j`` prints the whole ruleset as one line of JSON, longer than the
+        PTY netmiko holds reliably takes. Read-only; root because both nft and
+        iptables-save need ``CAP_NET_ADMIN`` (NetOrk/netork#1344).
+        """
+        return self.run_command(command, privileged=privileged, timeout=60).stdout
+
     def _run_virtual_ips_command(self, command: str, *, privileged: bool) -> str:
         """The transport for ``VirtualIpsMixin.get_virtual_ips``: an exec channel.