#4252 cfgmgmt firewall: iptables and firewalld report compliant from a destination-scoped rule

iptablesRuleMatches and firewalldRuleMatches in cfgmgmt/extensions/models/firewall.ts ignore the destination (and iptables ignores comments). A config with no destination therefore matches a rule limited to one destination and reports compliant even though the wanted rule is missing, and ensure absent then targets a rule that differs from the match: iptables -D fails with Bad rule. ufw does not have this problem. Tightening is not a simple fix, because apply would then add a broader allow rule on hosts where nothing changes today. Found while planning swamp-club#4230, which keeps this behaviour for configs that do not set the new arguments.