Firewall rules should allow for ICMP Code/Type to be selected

[FelixMcFelix]

User-facing services (nexus) want to be able to support path MTU discovery for end users. This requires that we allow for a subset of ICMP messages to transit from Nexus's zone out of OPTE -- in this case, type 3 & code 4 (Destination Unreachable//Fragmentation Needed and Don't Fragment was Set). However, we do not want to open up all of ICMP to the Internet writ large!

We need to be able to express constraints on ICMP code/type in individual firewall rules (individual, set, ranges, etc.) to allow for targeted control of ICMP traffic.

Follows on from oxidecomputer/omicron#7998. Connected to #369 as part of the wider PMTUD story.