fix rule generation for destination aliases in dual-stack scenarios

[wojcik91]

Avoid generating invalid rules for destination aliases in IPv6-enabled locations when the alias has no IPv6 destination.
Do the same for IPv4.

This continues work from #1868 and aligns destination alias handling with manually specified destinations.

Also improve test coverage around the ACL functionality.

Closes #2117

[Copilot]

Pull request overview

This PR fixes firewall rule generation for destination aliases in dual-stack locations so rules are only emitted for an IP family when the alias actually contains destinations for that family (avoiding unintended “allow any” rules). It also expands ACL/firewall test coverage for alias interactions and edge cases.

Changes:

• Gate destination-alias rule generation by IP-family presence (v4/v6) while still supporting “no destination = any destination” semantics.
• Add extensive SQLx-based tests covering empty aliases, mixed-family aliases, range-only aliases, and alias/manual destination interactions.
• Ignore local .zellij_layout.kdl file in .gitignore.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated 3 comments.

File	Description
crates/defguard_core/src/enterprise/firewall/mod.rs	Adds IP-family checks to prevent generating rules with missing daddr for the other family when using destination aliases.
crates/defguard_core/src/enterprise/firewall/tests.rs	Adds/updates ACL firewall tests for dual-stack and alias destination edge cases.
.gitignore	Adds .zellij_layout.kdl to ignored files.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 3 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.