Role ipt-server: sync with ipt-server repo (93d9af8); adapt extract-fw-host-vars.py.

- Update firewall scripts and shared conf files from firewall/ipt-server
  (HTTP connection limits, IPv6 TCP MSS clamping, ban_ipv6_mask,
  mattermost TCP fallback, rename 'stansard_*' -> 'standard_*').
- New role variables: fw_set_max_new_http_conn_per_ip_per_second,
  fw_max_http_new_conn_per_ip_per_second, fw_set_max_concurrent_http_conn_per_ip,
  fw_max_concurrent_http_conn_per_ip, fw_set_max_new_http_conn_per_second,
  fw_max_new_http_conn_per_second, fw_throttle_tcp6_mss_for_https,
  fw_tcp6_mss_for_https_val, fw_mm_tcp_ports_in, fw_ban_ipv6_mask.
- Split fw_blocked_ips into fw_blocked_ips_v4 / fw_blocked_ips_v6 and
  rename it in host_vars accordingly.
- Restart firewall when scripts or shared conf files change.
- extract-fw-host-vars.py: map new variables, normalize '${var}' and renamed
  bash variables, fall back to IPv6 for shared variables and warn if IPv4
  and IPv6 values differ.
- README.md / MIGRATION.md: document host_vars naming
  (<short-hostname>-ipt-server.yml) and new variables.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/ipt-server/files/etc/ipt-firewall/include_functions.conf

@@ -73,6 +73,54 @@ containsElement () {
    return 1
 }
 
+## - Expand a given IPv6 address (parameter 1) to 32 hex digits without colons.
+## - Returns 1 if the address cannot be parsed.
+## -
+ipv6_expand() {
+   local _addr="${1,,}"
+   local _head _tail _group _n _out=""
+   local -a _h=() _t=()
+
+   if [[ "$_addr" == *::* ]] ; then
+      _head="${_addr%%::*}"
+      _tail="${_addr#*::}"
+      [[ "$_tail" == *::* ]] && return 1
+      [[ -n "$_head" ]] && IFS=':' read -ra _h <<< "$_head"
+      [[ -n "$_tail" ]] && IFS=':' read -ra _t <<< "$_tail"
+      _n=$(( 8 - ${#_h[@]} - ${#_t[@]} ))
+      [[ $_n -lt 1 ]] && return 1
+      for (( ; _n > 0; _n-- )) ; do
+         _h+=("0")
+      done
+      _h+=("${_t[@]}")
+   else
+      IFS=':' read -ra _h <<< "$_addr"
+   fi
+
+   [[ ${#_h[@]} -eq 8 ]] || return 1
+   for _group in "${_h[@]}" ; do
+      [[ "$_group" =~ ^[0-9a-f]{1,4}$ ]] || return 1
+      _out+="$(printf '%04x' "0x$_group")"
+   done
+
+   echo "$_out"
+}
+
+## - Check if a given IPv6 address (parameter 1) lies within the network
+## - given by address (parameter 2) and prefix length (parameter 3).
+## -
+ipv6_in_net() {
+   local _a _n _full _rest
+   _a="$(ipv6_expand "$1")" || return 1
+   _n="$(ipv6_expand "$2")" || return 1
+   _full=$(( $3 / 4 ))
+   _rest=$(( $3 % 4 ))
+
+   [[ "${_a:0:_full}" == "${_n:0:_full}" ]] || return 1
+   [[ $_rest -eq 0 ]] && return 0
+   (( (0x${_a:_full:1} >> (4 - _rest)) == (0x${_n:_full:1} >> (4 - _rest)) ))
+}
+
 is_number() {
 
    return $(test ! -z "${1##*[!0-9]*}" > /dev/null 2>&1);