feat: support append mode when updating network restrictions

[maxmetcalfe]

What kind of change does this PR introduce?

API improvement

What is the current behavior?

Currently, running network-restrictions update will replace all existing restrictions with the provided list. This makes it easy to wipe all existing restrictions when adding a new one.

What is the new behavior?

network-restrictions update will now add the provided restrictions to the existing list. This matches the behavior of the "Add restriction" in the Supabase UI.

[coveralls]

Pull Request Test Coverage Report for Build 19497490251

Warning: This coverage report may be inaccurate.

This pull request's base commit is no longer the HEAD commit of its target branch. This means it includes changes from outside the original pull request, including, potentially, unrelated coverage changes.

• For more information on this, see Tracking coverage changes with pull request builds.
• To avoid this issue with future PRs, see these Recommended CI Configurations.
• For a quick fix, rebase this PR at GitHub. Your next report should be accurate.

Details

• 25 of 38 (65.79%) changed or added relevant lines in 3 files are covered.
• 57 unchanged lines in 3 files lost coverage.
• Overall coverage increased (+0.006%) to 55.082%

---

Changes Missing Coverage	Covered Lines	Changed/Added Lines	%
internal/restrictions/get/get.go	0	1	0.0%
cmd/restrictions.go	0	2	0.0%
internal/restrictions/update/update.go	25	35	71.43%

Files with Coverage Reduction	New Missed Lines	%
internal/gen/keys/keys.go	5	12.9%
internal/db/start/start.go	25	82.45%
internal/start/start.go	27	65.52%

Totals
Change from base Build 19427598841:	0.006%
Covered Lines:	6530
Relevant Lines:	11855

---

💛 - Coveralls

[sweatybridge]

This would be a breaking change for those who rely on the current behaviour. Could you introduce a new --append flag to the update command instead?

[maxmetcalfe]

thanks @sweatybridge. updated!