targets in ResolvedVpcFirewallRule should not scale linearly with the number of instances in a VPC #8306
Description
(Breaking out of https://github.com/oxidecomputer/customer-support/issues/448)
The vpc:default target in many of our rules is expanded out to the set of all NICs in the VPC, which is then repeated per-rule. A target today must be a NetworkInterface.
At the very least, we should be pruning the set of targets to the NICs we actually expect will be present on the target sled. I think we can go further and have similar expressions to filters (e.g., a target can be a VNI, or just the ID of a NIC), although I appreciate there is something useful in having nexus always specify the exact set of NICs who should install a rule.
We could also pull targets up a level in the struct (s.t. we send a set of rules for each common set of targets), but I'm less keen on that.