setting expose to true does not open port 9275 required for nrpe alerts

### Bug Description

When deploying cos-proxy on a public cloud or private cloud such as OpenStack, setting `expose: true` in the charm config should instruct the charm to add a security group rule to allow ingress TCP port 9275.
This is needed for an external entity to scrape the nrpe alerts (e.g. Prometheus).

### To Reproduce

juju expose cos-proxy

### Environment

Openstack

### Relevant log output

```shell
N/A
```

### Additional context

_No response_

Start by tracing how the cos-proxy charm handles the expose configuration and cloud security-group rules. Reproduce the issue with `juju expose cos-proxy` on OpenStack, then verify that exposing the charm permits external TCP ingress on port 9275 for NRPE alert scraping.

Written by the indexing model from the issue text.