fix: Allow SSH on first boot

[CooperWang0912]

PR Description

• As seen in Issue 4616, the user can get locked out from the device due to the ufw not allowing SSH on first boot
• This PR introduces a confirmation page that is triggered when the user has both ufw and OpenSSH in their packages,[Note 1] and a first boot service that enables SSH through ufw
• Closes Installing ufw together with sshd does not add the corresponding ssh ufw allow rule #4616

Technical Details

1. Added confirmation page function confirm_ufw that is called in guided.py, which prompts the user to allow SSH when both ufw and OpenSSH are present.[Note 2] The implementation is as follows:

async def confirm_ufw(config: ArchConfig) -> bool:
	firewall_config = config.app_config.firewall_config
	is_ufw = firewall_config and firewall_config.firewall and firewall_config.firewall.value == 'ufw'
	has_openssh = 'openssh' in config.packages

	if not (is_ufw and has_openssh):
		return True

	else:
		header = f'{tr("You have both ufw and OpenSSH in your packages")}. '
		header += tr('Would you like to allow incoming SSH connections through the firewall?') + '\n'
		group = MenuItemGroup.yes_no()

		result = await Confirmation(
			group=group,
			header=header,
			allow_skip=False,
			preset=True,
		).show()

		if result and result.get_value():
			config.app_config.firewall_config.allow_ssh = True

	return True

2. Created helper function _allow_ufw_ssh_on_first_boot, which creates a service on first boot that enables SSH. The implementation is seen below:

def _allow_ufw_ssh_on_first_boot(self, install_session: Installer) -> None:
	service_content = """[Unit]
		Description=Allow SSH in UFW on first boot
		After=ufw.service
		Wants=ufw.service
		[Service]
		Type=oneshot
		ExecStart=/usr/bin/ufw allow SSH
		ExecStartPost=/usr/bin/systemctl disable ufw-allow-ssh.service
		[Install]
		WantedBy=multi-user.target
	"""
	service_path = install_session.target / 'etc/systemd/system/ufw-allow-ssh.service'
	service_path.write_text(service_content)
	install_session.enable_service(['ufw-allow-ssh.service'])

3. Updated the FirewallConfiguration and other relevant classes to include the field allow_ssh

Tests and Checks

• I have tested the code!

SSH is successfully enabled on first boot.

Notes:

1. Thanks to @KsanDjordje for coming up with this idea
2. If this approach seems too extreme and disruptive to the overall flow of the installation process, we can also remove the confirmation page in favor of a warning that points the user to the allow_ssh field in the Application -> Firewall tab, similar to the network configuration warning