Role ipt-server: configurable rate for the new-TCP-connection limit; new defaults.

- Sync ipt-firewall-server, ip6t-firewall-server and default_settings.conf
  with firewall/ipt-server affa35d: new limit_new_tcp_connections_per_seconds_rate
  (default 30, burst twice the rate); the rule now only drops SYNs above the
  limit instead of accepting those below it; several IPv6 fixes.
- defaults: fw_limit_new_tcp_connections_per_seconds_per_source_IP: false,
  fw_limit_new_tcp_connections_per_seconds_ports: "80,110,143,443,465,995",
  new fw_limit_new_tcp_connections_per_seconds_rate (overridable with _v6).
- templates, extract-fw-host-vars.py, README: new variable and defaults.
- oolm-shop: drop fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6
  (it would have enabled the limit for IPv6 with the new default ports).
- piwik: fw_manage_config: true, per_IP_connection_limit 501, no
  new-connection limit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

extract-fw-host-vars.py

@@ -168,8 +168,9 @@ DEFAULTS = {
     "fw_protection_against_ssh_brute_force_attacks": True,
     "fw_limit_connections_per_source_IP": True,
     "fw_per_IP_connection_limit": "$default_per_IP_connection_limit",
-    "fw_limit_new_tcp_connections_per_seconds_per_source_IP": True,
-    "fw_limit_new_tcp_connections_per_seconds_ports": "",
+    "fw_limit_new_tcp_connections_per_seconds_per_source_IP": False,
+    "fw_limit_new_tcp_connections_per_seconds_ports": "80,110,143,443,465,995",
+    "fw_limit_new_tcp_connections_per_seconds_rate": "$default_limit_new_tcp_connections_per_seconds_rate",
     "fw_kernel_activate_forwarding": False,
     "fw_kernel_support_dynaddr": False,
     "fw_dynaddr_flag": "5",
@@ -302,6 +303,7 @@ MAIN_SHARED = {
     "per_IP_connection_limit": "fw_per_IP_connection_limit",
     "limit_new_tcp_connections_per_seconds_per_source_IP": "fw_limit_new_tcp_connections_per_seconds_per_source_IP",
     "limit_new_tcp_connections_per_seconds_ports": "fw_limit_new_tcp_connections_per_seconds_ports",
+    "limit_new_tcp_connections_per_seconds_rate": "fw_limit_new_tcp_connections_per_seconds_rate",
 }
 
 # IPv4-only variables (from main_ipv4.conf)
@@ -687,7 +689,8 @@ def render_yaml(hostname, host_vars, all_warnings):
                                   "fw_protection_against_ssh_brute_force_attacks",
                                   "fw_limit_connections_per_source_IP", "fw_per_IP_connection_limit",
                                   "fw_limit_new_tcp_connections_per_seconds_per_source_IP",
-                                  "fw_limit_new_tcp_connections_per_seconds_ports"]),
+                                  "fw_limit_new_tcp_connections_per_seconds_ports",
+                                  "fw_limit_new_tcp_connections_per_seconds_rate"]),
         ("Kernel IPv4", ["fw_kernel_support_dynaddr", "fw_dynaddr_flag",
                           "fw_kernel_reduce_timeouts", "fw_kernel_tcp_syncookies",
                           "fw_kernel_protect_against_icmp_bogus_messages",