Stateful firewall for unmanaged homenet clients

[delroth]

By default, devices in the homenet should likely be considered unsafe and v6-firewalled from the outside world. Devices explicitly configured as safe or part of infra.delroth.net can avoid stateful firewalling for more performance.