Support setting targets on firewall rules

Using the gce_net module you can't set rules that allow traffic from the inside to certain instances. This patch allows you to list tags of instances that should be the target of the rules.