Allow UDP outbound for allowed endpoints in block mode

[hemantkumar-dev]

Summary

Fixes #220

In block mode, the agent previously installed ACCEPT rules only for TCP on allowed endpoints, then rejected everything else. That blocked QUIC / HTTP/3 (UDP) traffic to the same allowed hosts even though they were explicitly permitted.

This change installs matching UDP ACCEPT rules alongside TCP for:

• static allowed endpoints in addBlockRules (used when applying the initial block-mode policy)
• dynamically resolved endpoints in InsertAllowRule (OUTPUT + DOCKER-USER), via a small insertAllowRuleForProtocol helper

Unrelated paths are unchanged (Azure IMDS, metadata, private ranges, audit-mode DNS UDP/53 logging, global blocklist).

Why this matters

Workflows that allow an endpoint under egress-policy: block could still fail for modern clients that negotiate HTTP/3 over UDP/443. Aligning UDP with TCP for allowed endpoints keeps block mode consistent with user intent.

Changes

• firewall.go: allow TCP + UDP for configured/resolved endpoints in block mode
• firewall_blocklist_test.go: mock iptables coverage for TCP+UDP allow rules and updated InsertAllowRule expectations
• firewall_test.go: real iptables assertions for TCP+UDP on OUTPUT / DOCKER-USER, plus Test_InsertAllowRule_AddsTCPAndUDP

Test plan

• TestInsertAllowRule_AllowsWhenBlocklistIsNil expects 4 rules (tcp+udp x OUTPUT + DOCKER-USER)
• TestAddBlockRules_AllowsTCPAndUDPForEndpoints verifies TCP and UDP ACCEPT for allowed endpoint
• TestInsertAllowRule_SkipsGlobalBlocklistedIP still skips allow rules for blocked IPs
• Test_addAuditRules asserts TCP+UDP ACCEPT on real iptables (linux)
• Test_InsertAllowRule_AddsTCPAndUDP asserts TCP+UDP ACCEPT on real iptables (linux)
• CI sudo go test on ubuntu-latest
• Optional manual check: harden-runner egress-policy: block with an HTTP/3 endpoint and curl --http3

Notes for reviewers

• UDP is allowed only for the same destination IP/port pairs that are already allowed for TCP; non-allowed destinations remain rejected.
• Comments intentionally describe the behavior (QUIC/HTTP/3) without embedding issue links in code.