firewall: T9474: keep time windows correct across UTC offset changes

nft converts hour matches to UTC when the ruleset is loaded, using the
offset of that moment. After a daylight saving change, or a change of the
system time-zone, every hour window was off until the next firewall commit.

- A new helper loads only the rules with an hour match again, in place, so
  sets such as dynamic, domain and GeoIP groups and all counters are kept.
  It is scheduled as a systemd timer for the next UTC offset change and
  re-arms itself; firewall and policy route commits arm or remove it.
- Changing the time-zone re-runs firewall and policy route.

The smoketest moves the clock to just before a change in Europe/Berlin and
checks that the window is refreshed and a dynamic group entry survives. It
only runs in the smoketest harness, as it changes the system clock.

0 files changed, 0 insertions, 0 deletions