convert firewall service to new serviceDefn

this is a bit kludgey with dependencies, need to
come back and look at that

examples/rotuer.nix

@@ -168,7 +168,7 @@ in rec {
     dependencies = [ services.wan ];
   };
 
-  services.firewall = svc.firewall {
+  services.firewall = svc.firewall.build {
     ruleset = import ./rotuer-firewall.nix;
   };