Automate firewalld Rules

Security wants every firewall change scripted and persistent. `ansible.posix` is already installed in `~/ansible/collections`. Each rule must be active now **and** survive a reload/reboot.

Tasks

1. Write ~/ansible/firewall.yml: allow services http and https in the default zone on the webservers only, permanently and immediately.
2. Add a play to firewall.yml: open 8080/tcp on dev (permanent and runtime).
3. Add a rich rule on the prod group that accepts the mysql service from 10.10.10.0/24 only (permanent and runtime): rule family="ipv4" source address="10.10.10.0/24" service name="mysql" accept.
4. Write ~/ansible/hardening.yml: remove the cockpit service from the default zone on test, permanently and immediately.
5. In hardening.yml, add source 192.168.50.0/24 to the trusted zone on dev (permanent and runtime).