refactor(network): move Firewall to UOContent; core keeps only the filter seam

Core now owns the question -- "should this socket be denied?" -- and none of the
answers. The firewall was the last implementation left in core, and the reasons
to keep it did not survive scrutiny: it is not extended downstream, and a shard
running bare core has no way to populate it anyway, since the admin gump and
the commands that mutate it are both content. Larger shards front the server
with an upstream proxy or edge scrubbing and never use it; it survives as the
fallback an admin reaches for over a single player, which is squarely content's
concern.

Nothing about the firewall changes for operators: same Server.Network namespace,
same Configuration/firewall.json, same gump and commands, same legacy .cfg
migration. It reaches the accept path through ConnectionFilters like any other
filter, and registers itself first because an empty set is the cheapest gate.

Untangling core from the firewall entry types first:

- NetworkUtilities built its reserved-network tables out of CidrFirewallEntry,
  which made core depend on the firewall for something with nothing to do with
  banning. Those are constant CIDR blocks answering "is this address in one of
  these ranges?", so they are now a SortedRangeIndex<UInt128> -- the same
  primitive the firewall and blocklist already share. Same semantics, same
  public API, one linear scan replaced by a binary search.
- The CIDR -> normalized range parse those tables needed is now
  IPAddressUtility.TryParseCidrRange, and CidrFirewallEntry drops its private
  copy of that logic in favor of it.

Core no longer references IFirewallEntry or Firewall anywhere. 1344 tests pass.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Projects/Server/Utilities/IPAddressUtility.cs

@@ -72,6 +72,49 @@ public static class IPAddressUtility
         return new IPAddress(bytes);
     }
 
+    /// <summary>
+    /// Parses <c>a.b.c.d/n</c>, <c>::/n</c>, or a bare address (treated as a single-host range) into an
+    /// inclusive <see cref="UInt128"/> range in normalized IPv6 form. A bare IPv4 prefix is widened by 96
+    /// bits so v4 and v6 ranges are directly comparable. Returns false on anything malformed.
+    /// </summary>
+    public static bool TryParseCidrRange(ReadOnlySpan<char> cidr, out UInt128 min, out UInt128 max)
+    {
+        min = default;
+        max = default;
+
+        var slash = cidr.IndexOf('/');
+        if (!IPAddress.TryParse(slash >= 0 ? cidr[..slash] : cidr, out var ip))
+        {
+            return false;
+        }
+
+        var isV6 = ip.AddressFamily == AddressFamily.InterNetworkV6;
+        var maxPrefixLength = isV6 ? 128 : 32;
+        int prefixLength;
+
+        if (slash < 0)
+        {
+            prefixLength = maxPrefixLength;
+        }
+        else if (!int.TryParse(cidr[(slash + 1)..], out prefixLength) ||
+                 prefixLength < 0 || prefixLength > maxPrefixLength)
+        {
+            return false;
+        }
+
+        if (!isV6)
+        {
+            prefixLength += 96; // 32 -> 128
+        }
+
+        Span<byte> bytes = stackalloc byte[16];
+        ip.WriteMappedIPv6To(bytes);
+
+        min = Utility.CreateCidrAddress(bytes, prefixLength, false);
+        max = Utility.CreateCidrAddress(bytes, prefixLength, true);
+        return true;
+    }
+
     /// <summary>Extracts the big-endian uint of an <see cref="AddressFamily.InterNetwork"/> address.</summary>
     public static bool TryV4(IPAddress ip, out uint v)
     {