(MODULES-443) Deprecate unset proto

iptables defaults to the protocol `all` for its rules, but the firewall
type defaults to `tcp`. We want to change the default, but will issue a
deprecation warning in the mean time.