Fix firewall rule discovery so quoted values are not scanned as real iptables options.

[ashishrase]

Summary
Fix firewall rule discovery so quoted values are not scanned as real iptables options.

Today rule_to_hash in lib/puppet/provider/firewall/firewall.rb parses the full raw iptables-save line with regexes for most attributes. That means flag-like text inside quoted values, such as a comment containing -p -p or ! -p -p, can be misread as a real protocol flag. Once that happens, process_get receives a malformed proto value and discovery can later fail with Unsupported proto number: -p.

This change fixes the parser at the source by:

• creating a quote-stripped search copy of the rule for non-quoted attributes
• continuing to parse quoted attributes (name, string, string_hex, bytecode, u32, nflog_prefix, log_prefix) from the original rule
• preserving existing behavior for real protocol flags such as -p tcp
• preserving the existing proto => all fallback when no real protocol is present

Also adds provider test coverage for:

• unit parsing: quoted comments containing -p -p do not set proto
• unit parsing: quoted comments containing ! -p -p do not set proto
• unit parsing: a real -p tcp outside quotes still parses as proto => tcp
• end-to-end parsing: get returns proto => all when no real protocol is present and does not surface -p / ! -p as protocol values

Additional Context
[ X ] Root cause and the steps to reproduce. (If applicable)
[ X ] Thought process behind the implementation.

Root cause / reproduction
On affected systems (Rancher Kubernetes), iptables-save output may include quoted comment text containing flag-like tokens such as -p -p. Because rule_to_hash scans the full raw rule line, that quoted text can be mistaken for a real protocol option and stored as proto => '-p'. Later in the discovery pipeline this can surface as:

Unsupported proto number: -p

This can cause Puppet::Type.type(:firewall).instances to fail during rule discovery.

Thought process behind the implementation
The goal of this change is to fix the root cause in the provider parser rather than make downstream protocol conversion more tolerant of malformed intermediate values.

process_get already handles a missing protocol by defaulting to all, so the correct fix is to stop rule_to_hash from manufacturing invalid protocol values in the first place. Using a quote-stripped search copy for non-quoted attributes keeps the parser behavior intact for real rule options while preventing quoted comment text from being interpreted as flags.

Related Issues (if any)
No linked issue yet.

Checklist
[ X ] 🟢 Spec tests.
[ ] 🟢 Acceptance tests:
Acceptance tests were not run locally because Docker/Litmus provisioning is not available in my environment.
[ X ] Manually verified. (For example puppet agent -t on an affected system)

[CLAassistant]

All committers have signed the CLA.

[ashishrase]

Need few more test to be done