firewall: use watch-outputs to track changes in zone->interface map

includes a horrible hack to work around (claimed (by me)) deficiencies
in the nftables parser

pkgs/output-template/output-template.fnl

@@ -25,9 +25,9 @@
         myenv {
                : string
                :output
-               (fn [service-path path]
+               (fn [service-path path default]
                  (let [s (assert (svc.open (.. service-path "/.outputs")))]
-                   (s:output path)))
+                   (or (s:output path) default)))
                :lua_quote #(string.format "%q" %1)
                :json_quote (fn [x] (.. "\"" (json-escape x) "\""))
                }]