firewall: add support for TCP/UDP port ranges

This adds support for port ranges to `firewall.nix`, which is a surprising omission that I encountered. This is particularly useful for packages like `mosh`, which use a wide UDP port range by default for incoming connections (60000 to 61000), and without it makes such a package much more annoying to support.