Make firewall rules for externally reachable rack services operator configurable

When the control plane sets up firewall rules for externally reachable services, they are fixed and conservative. For example, the firewall rules for nexus will allow incoming HTTPS connections, but not incoming ICMP echo requests. This is not a one size fits all problem. Some operators will want more restrictive rules where endpoints are only reachable over the protocols they are providing services on, others will require that service endpoints respond to other types of messages such as ICMP echo requests as this can aid in debugging and is used by some availability monitoring tools. Today end users can control firewall rules for their instances, but operators have no such knobs for services.

The issue names no files, tests, or entry points. Start by locating the control-plane code that creates firewall rules for externally reachable rack services and reviewing how operator configuration is exposed. Done means operators can choose appropriate rules for these services, including whether protocols such as ICMP are allowed, with coverage for the resulting behavior.