#4230 cfgmgmt firewall: match rules by destination and comment

Problem

@swamp/cfgmgmt firewall identifies a rule only by port, protocol, action, direction and source (ufwLineMatches in cfgmgmt/extensions/models/firewall.ts). Many deployments create several rules that share those fields and differ only by destination address. They usually also tag each rule with a comment, for example ufw allow from [IP-1]/24 to [IP-2] port 8080 proto tcp comment 'app-42-lan'.

For these rules the model can't express "this exact rule". ensure: absent either matches nothing, or would match several rules that share port and source. Users then fall back to shell steps that parse ufw status numbered. Those rule numbers are positions, not stable IDs, and they shift after every delete.

Proposal

Add two optional global arguments to the firewall model:

• destination: a CIDR or address, matched against the UFW To column (<dest> <port>/<proto>), the firewalld rich-rule destination address, and iptables -d.
• comment: a string. For UFW, add it with comment '<text>' and match it against the # <text> suffix shown by ufw status. Backends without comments ignore it, or reject it if that's clearer.

With either one set, check/apply match on it too, so ensure: present|absent manages exactly one rule. Existing configurations without them behave as today.

Example

port: 8080
protocol: tcp
action: allow
source: [IP-1]/24
destination: [IP-2]
comment: app-42-lan
ensure: absent

This removes only the rule for app-42, and leaves other rules on port 8080 from the same source alone.