Create an automated test suite for the anti-SSRF iptables rules

[time-scout]

The core security feature of this repository is blocking the OpenClaw container from reaching the cloud provider's Instance Metadata Service (IMDSv2 at 169.254.169.254). We need an automated way (e.g., via a simple bash test script run post-Ansible) to verify that: 1) The rules are correctly inserted at the top of the OUTPUT chain. 2) A request initiated by the node user (or its SubUID) to 169.254.169.254 is definitively DROPped.