docs: improve Host Firewall GSG

[qmonnet]

As part of the validation of GSGs (#13627) for the 1.9 release, here are several improvement suggestions for the Host Firewall GSG.

Fixes:

• Fix Helm option: --set devices=ethX,ethY does not work (missing curly braces and quotes).
• Rename one occurrence of access=ssh into node-access=ssh, for consistency.
• Add a missing closing parenthesis at the end of the command that sets the HOST_EP_ID variable.
• Use jsonpath and kubectl's options in one command to avoid piping the output to jq.

Additions:

• Explain what the interfaces passed to the --devices option are for. This is mostly copied from the description in the Host Policies description (Layer 3 Examples).
• Explain that per-endpoint routing is not compatible with the host firewall and must be disabled, in particular on managed environments like GKE.
• Add node label removal to the clean-up section.
• Format shell session code as shell session code.

[pchaigno]

Thanks! It's great to get 👀 on this guide 🎉

[qmonnet]

Amended according to Paul's feedback.

Incremental diff

diff --git a/Documentation/gettingstarted/host-firewall.rst b/Documentation/gettingstarted/host-firewall.rst
index c4b3a704659d..535069f4d172 100644
--- a/Documentation/gettingstarted/host-firewall.rst
+++ b/Documentation/gettingstarted/host-firewall.rst
@@ -22,16 +22,16 @@ Enable the Host Firewall in Cilium
 
 Deploy Cilium release via Helm:
 
-.. code:: shell-session
+.. parsed-literal ::
 
-    $ helm install cilium |CHART_RELEASE|      \\
+    helm install cilium |CHART_RELEASE|        \\
       --namespace kube-system                  \\
       --set hostFirewall=true                  \\
       --set devices='{ethX,ethY}'
 
-The ``devices`` refer to the network devices Cilium is configured on such as
-``eth0``. Omitting this option leads Cilium to auto-detect what interfaces the
-host firewall applies to.
+The ``devices`` flag refers to the network devices Cilium is configured on such
+as ``eth0``. Omitting this option leads Cilium to auto-detect what interfaces
+the host firewall applies to.
 
 At this point, the Cilium-managed nodes are ready to enforce network policies.
 
@@ -51,11 +51,6 @@ At this point, the Cilium-managed nodes are ready to enforce network policies.
 Attach a Label to the Node
 ==========================
 
-.. note::
-
-    This must be done *after* deploying Cilium, or the agent may not pick up
-    the change.
-
 In this guide, we will apply host policies only to nodes with the label
 ``node-access=ssh``. We thus first need to attach that label to a node in the
 cluster.
@@ -87,8 +82,8 @@ recommended for production deployment*.
     $ HOST_EP_ID=$(kubectl -n $CILIUM_NAMESPACE exec $CILIUM_POD_NAME -- cilium endpoint list -o jsonpath='{[?(@.status.identity.id==1)].id}')
     $ kubectl -n $CILIUM_NAMESPACE exec $CILIUM_POD_NAME -- cilium endpoint config $HOST_EP_ID PolicyAuditMode=Enabled
     Endpoint 3353 configuration updated successfully
-    $ kubectl -n $CILIUM_NAMESPACE exec $CILIUM_POD_NAME -- cilium endpoint config $HOST_EP_ID -o jsonpath='{.realized.options.PolicyAuditMode}'
-    Enabled
+    $ kubectl -n $CILIUM_NAMESPACE exec $CILIUM_POD_NAME -- cilium endpoint config $HOST_EP_ID | grep PolicyAuditMode
+    PolicyAuditMode          Enabled
 
 
 Apply a Host Network Policy