Improved firewall rule handling

[skpaterson]

Improve handling specifically for the below use-cases:

• Ensure ingress tcp:22 is only allowed for a specific set of IP ranges
• Ensure fw-rule 'foo' only allows ingress for target_labels 'bar'

[clintoncwolfe]

Have a look at how aws_security_group handles this using matchers allow_in?, allow_out, allow_in_only? and allow_out_only See https://www.inspec.io/docs/reference/resources/aws_security_group/#allow_in

Which, charmingly, has docs errors. Sigh.