systemd: Support reload scripts
nixos/firewall: Don't allow traffic during reload
Merge pull request #4108 from wkennington/master.firewall

Firewall: Don't allow traffic during nixos-switch / reload
nixos/firewall: Support extraStopCommands
nixos/nat: Leverage firewall module