feat(validation): add firewall validation for iptables/ufw rules

[theFong]

Summary

• Add networking_validation.go with ValidateFirewallBlocksPort and ValidateDockerFirewallBlocksPort to verify servers on 0.0.0.0 are not accessible from outside
• Extract instance validation functions to instance_validation.go for better organization
• Add RunFirewallValidation standalone suite for comprehensive firewall testing
• Integrate ValidateFirewallBlocksPort and ValidateDockerFirewallBlocksPort into RunInstanceLifecycleValidation

This validates that the iptables rules from BREV-2599 are working correctly by verifying that Docker containers binding to 0.0.0.0 on non-allowed ports cannot be reached from outside.

Validation Proof

Tested via PR #82 which flushed the DOCKER-USER iptables chain to simulate the vulnerable state:

Without iptables rules (vulnerable):

Chain DOCKER-USER (1 references)
 pkts bytes target     prot opt in     out     source               destination         
(empty - no rules)

Result: port 9999 is accessible from outside but should be blocked by firewall (attempt 1 succeeded) ❌ FAIL

With iptables rules (secure):

Chain DOCKER-USER (1 references)
    0     0 ACCEPT     all  --  *      *       0.0.0.0/0            0.0.0.0/0            ctstate RELATED,ESTABLISHED
    0     0 ACCEPT     all  --  lo     *       0.0.0.0/0            0.0.0.0/0           
    0     0 DROP       all  --  *      *       0.0.0.0/0            0.0.0.0/0           

Result: checkPortBlocked: confirmed port 9999 is blocked after 3 attempts ✅ PASS

Test plan

• CI passes
• Shadeform validation tests pass with firewall validation
• PR test: firewall validation should FAIL without iptables fix #82 confirmed test correctly detects missing iptables rules

[drewmalin]

Rebasing on main to ensure nebius tests now pass