iptables: persist ipsets across reboot to match rule persistence.
- Detect the ipset save-file + restore unit (RHEL ipset.service /
/etc/sysconfig/ipset; Debian netfilter-persistent / /etc/iptables/ipsets),
non-fatally.
- After each set mutation, `ipset save` into the layout's save-file and
auto-enable a present-but-disabled restore unit; warn when no mechanism
exists (sets stay live-only).
- Use ListUnitFiles (not ListUnitFilesByPatterns, which needs systemd >= 230;
CentOS 7 ships 219).
APF/CSF: gain address sets by persisting ipset commands in the pre-hook.
- The hook carries an `ipset create/flush/add` block ordered ahead of the
`-m set --match-set` rule lines, so the firewall recreates the set on every
(re)start before any rule references it.
- Route set-referencing rules (Source/Destination names an ipset) through the
hook rather than a literal trust-file line (ruleNeedsHook/bareHostShape).
- Implement the six address-set methods, advertise AddressSets, and wire sets
into Backup/Restore via captureBackupState/restoreBackupSets.
Validated live: reboot simulation for iptables; generated-hook source for
APF/CSF. Unit tests cover the hook ipset round-trip, ordering, in-use guard and
set-ref routing; the capability-gated integration subtest now covers APF/CSF.
