ImportExportPolicy::Allow - use a set instead of a vec?

The current definition of ImportExportPolicy is

pub enum ImportExportPolicy {
    /// Do not perform any filtering.
    #[default]
    NoFiltering,
    Allow(Vec<oxnet::IpNet>),
}

Putting the same Ipnet value inside the Allow(_) case multiple times fails at database insertion time. We could use a BTreeSet<oxnet::IpNet> instead, preventing duplicate values at the type level.

Should we permit ImportExportPolicy::Allow(_) with an empty set/list IpNets to allow? Or is the expectation that Allow(_) always has at least one entry?

(This came up working on some related unit tests in the context of #9832.)

Read the ImportExportPolicy definition and the related unit tests mentioned in #9832 first. Resolve whether Allow may contain zero IpNet values and whether BTreeSet is the intended representation; done means the policy semantics and duplicate-handling behavior are agreed and covered by the relevant tests.