[m-dilorenzi]

DPI rules can now use firewall objects as source, next to typed addresses: object changes are applied to the rules automatically and existing rules keep working unchanged.

• new list source objects API returns the objects usable as source (host sets, DHCP reservations, DNS records, VPN users with a reserved IP), domain sets excluded
• add rule and edit rule API's accept source_objects, a list of object ids; missing objects or users without a reserved IP are rejected
• list rules API returns source_objects with name, type, subtype and an empty flag, true when the object currently resolves to no address
• each referenced object is written to a netifyd address group (/etc/netifyd/address-groups.d/30-<type>_<id>.conf) and matched by the rule criteria, groups no longer referenced are removed
• the DPI configuration is reloaded when an object used by a rule changes, including a change of the reserved IP of a VPN user
• objects used by a DPI rule can't be deleted, and the error reports the rule name
• known limitation: a group removed from every rule is saved back by netifyd when it restarts; it is not referenced by any rule so it matches nothing, and it is removed again on the next DPI reload

Closes: #1985