feat(adblock): implement device-based enforcement and migration scripts

[m-dilorenzi]

This PR fixes the issue where DNS queries are no longer redirected to dnsmasq after the adblock upgrade to 4.5.5.

Up to adblock 4.1.5 the local DNS enforcement was configured with firewall zone names, and adblock turned them into UCI redirect sections letting fw4 resolve each zone into its devices. Since 4.5.5 adblock writes nftables rules directly and expects the adb_nftdevforce option to contain device names, because its values are used as-is in the iifname match. Zone names kept being stored there, so the resulting rules never matched any packet and DNS traffic was not intercepted.

The fix makes adb_nftdevforce a derived value: the zones selected in the UI are stored in a dedicated ns_tsdns_zones option and expanded into the devices of those zones. The UI is not affected, it keeps working with zones.

Changes

• packages/ns-api/files/ns.threatshield: dns_edit_settings now saves the selected zones in ns_tsdns_zones and writes the devices they contain into adb_nftdevforce; dns_list_settings reads the zones back from the new option, with a fallback that keeps the settings page working until the migration has run.
• packages/ns-threat_shield/files/configure-adblock-devices.py (new): pre-commit hook that recomputes adb_nftdevforce whenever adblock, firewall or network change, so that adding an interface to an enforced zone does not leave its DNS traffic unfiltered.
• packages/ns-threat_shield/files/adblock-devices-migrate.py (new): rebuilds the configuration on systems already upgraded, which would otherwise stay broken until someone re-saves the Threat Shield DNS settings, and restarts adblock.
• packages/ns-threat_shield/files/36_ns-threat_shield (new): uci-defaults running the migration above, following the same pattern used for the wireguard migration.
• packages/ns-threat_shield/Makefile: installs the new hook, migration and uci-defaults, and raises the ns-api requirement so the migration cannot be undone by an older API still writing zone names.

Closes: #1871