nftables: fixed QueueBypass for system rules

[banana-monkey-tree]

Queue rules declared in system-fw.json are always installed with the bypass flag, regardless of FwOptions.QueueBypass.

The daemon's own interception rules honour the setting — the three queue constructions in firewall/nftables/rules.go use n.getBypassFlag(). The verdict builder used for system rules hardcoded expr.QueueFlagBypass instead, next to a // TODO: allow to configure this flag.

This shows up with the mangle_forward rule shipped in system-fw.json ("Intercept forwarded connections (docker, etc)") — the rule suggested in #1175 for intercepting forwarded traffic. Enabling it with QueueBypass set to false installs:

ct state new queue flags bypass to 0

nftables documents bypass as letting packets through when no userspace program is listening on the queue, so a rule installed this way does not fail closed the way the interception rules do. I verified the installed flag, not packet delivery with a stopped listener.

The fix

Pass getBypassFlag() into NewExprVerdict and drop the TODO. AddSystemRule is its only production caller and already has the flag in scope; both the initial load and later system-rule reloads go through it.

The shipped default is QueueBypass: true, so default installations are unaffected — this changes behaviour only where it was explicitly set to false.

The test

TestSystemRuleQueueBypass goes through Init() with the existing fixture, once with bypass disabled and once enabled, and reads mangle_forward back from the kernel to compare the installed queue flags. It needs PRIVILEGED_TESTS=1 and namespace privileges, as the other tests in that file do, and skips otherwise.

Before the change it fails with:

system_test.go: QueueBypass=false: system rule queue flags = 0x1, expected 0x0

Tested on linux/arm64 with Go 1.27.1; the nftables and exprs packages pass.