Firewall-level blocking

# Problem Description

DNS filtering is a great way to block unsolicited content if the code downloading it depends on local DNS servers to find the IP address of the source endpoint. However code that uses its own (DoH, DoT, ...) name server or does not use name servers at all and works directly with IP adresses cannot be blocked this way.

### Proposed Solution

It would be a very attractive feature of AGH to integrate with firewall to manage IP address blacklist and monitor firewall log to be able to show blocked connections/packets list (the same way query log is shown today) and statistics.

Ideally there would be an abstraction for firewall management and monitoring with different implementations for each supported firewall. On Linux for example AGH could manage all IP addresses to block in its own iptables chain and use log rules and NF_LOG to learn about blocked connections/packets.

List of IP addresses to block should be a union of IPs from user-selected IP blacklists (similar to DNS blocklists UI) with IPs resolved from selected DNS blocklists. IPs coming from DNS blocklists should optionally be periodically re-resolved.

### Alternatives Considered

Alternative is to use different tool for this job. But since AdGuard Home already is a tool for this kind of job it would be great if it supported firewall-level blocking as well.