Role ipt-server: configurable rate for the new-TCP-connection limit; new defaults.

- Sync ipt-firewall-server, ip6t-firewall-server and default_settings.conf
  with firewall/ipt-server affa35d: new limit_new_tcp_connections_per_seconds_rate
  (default 30, burst twice the rate); the rule now only drops SYNs above the
  limit instead of accepting those below it; several IPv6 fixes.
- defaults: fw_limit_new_tcp_connections_per_seconds_per_source_IP: false,
  fw_limit_new_tcp_connections_per_seconds_ports: "80,110,143,443,465,995",
  new fw_limit_new_tcp_connections_per_seconds_rate (overridable with _v6).
- templates, extract-fw-host-vars.py, README: new variable and defaults.
- oolm-shop: drop fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6
  (it would have enabled the limit for IPv6 with the new default ports).
- piwik: fw_manage_config: true, per_IP_connection_limit 501, no
  new-connection limit.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

host_vars/oolm-shop.oopen.de/oolm-shop-ipt-server.yml

@@ -44,4 +44,3 @@ fw_limit_connections_per_source_IP_v6: true
 fw_per_IP_connection_limit: 2048
 fw_per_IP_connection_limit_v6: 1024
 fw_limit_new_tcp_connections_per_seconds_per_source_IP: false
-fw_limit_new_tcp_connections_per_seconds_per_source_IP_v6: true

host_vars/piwik.warenform.de/piwik-ipt-server.yml

@@ -3,7 +3,7 @@
 # Generated by extract-fw-host-vars.py - review before committing!
 # Place in: host_vars/<hostname>/<short-hostname>-ipt-server.yml
 
-fw_manage_config: false
+fw_manage_config: true
 
 # --- Network
 fw_ext_interfaces:
@@ -22,3 +22,7 @@ fw_http_server_ips: $ext_1_ip
 
 # --- Block
 fw_blocked_ips_v4: 222.184.0.0/13 61.160.0.0/16 116.8.0.0/14
+
+# --- Protection / limits
+fw_per_IP_connection_limit: 501
+fw_limit_new_tcp_connections_per_seconds_per_source_IP: false