dnsmasq: try without ra-stateless

ra-stateless means a client will get its address using RA advertisement
but will request the configuration (DNS) through DHCPv6. Let's try to
assign addresses with IPv6. Dunno if it works since the manual says that
constructor would work only for stateless DHCP/SLAAC
firewall: trusted net can access web server on firewall
firewall: make the previous commit really work
dnsmasq: switch to Google DNS to use DNSSEC

Not ideal at all. But I value more DNSSEC than privacy. Maybe it would
be better to install unbound locally and ask dnsmasq to use it.
firewall: be a bit more generic in how we handle IPv6 subnetting