feat(sfcompute): opt in to public IPs and configurable ingress

[masonsfc]

SFCompute V2 instances expose SSH through a proxy, so Brev cannot open application ports. This adds opt-in public IPv4 and configurable ingress. It requires the server lifecycle change in https://github.com/sfcompute/sfcompute/pull/11133, building on the merged networking endpoints in https://github.com/sfcompute/sfcompute/pull/11069.

• Add enable_configurable_firewall to credentials, defaulting to false, and select public-IP-capable SKUs advertised by the pool.
• Send firewall rules with the instance creation request. SFCompute creates and attaches the firewall, records its ownership, and deletes it on termination when unused.
• Preserve SSH on TCP 22/2222 and apply application port ranges to TCP and UDP. Expose stable rule IDs for revocation and retry conditional edits without overwriting concurrent changes.
• Return the public IP and retain the termination cleanup fallback for existing instances. Reject unsupported outbound restrictions.

Deploy SFC #11133 before enabling the credential option. SFC firewall and instance creation commit separately; a process interruption between them can leave an unused firewall. Ordinary creation failures attempt cleanup, and failed termination cleanup can be retried.

Validation: provider tests with race detection, go vet, golangci-lint, gofumpt, Codespell, and git diff --check pass. Coverage includes inline rules, default-off clients, unsupported servers, lifecycle cleanup and retry, rejected/unacknowledged creates, and concurrent rule edits. No live cloud instances were created.