feat!: migrate ufw to custom resources

[damacus]

Summary

• replace the legacy recipe-and-attribute workflow with a ufw_firewall custom resource and shared helper module
• add LIMITATIONS.md, resource documentation, ChefSpec coverage, and a new test cookbook/InSpec default suite
• modernize the kitchen and CI platform matrix for current Debian and Ubuntu targets and remove the legacy recipes/, attributes/, and kitchen.exec.yml structure

Verification

• cookstyle
• chef exec rspec --format documentation
• chef exec berks install
• chef exec kitchen converge default-ubuntu-2404
• second chef exec kitchen converge default-ubuntu-2404 completed with Infra Phase complete, 0/11 resources updated
• chef exec kitchen verify default-ubuntu-2404

[github-actions]

Slowest examples

Top 10 slowest examples (0.52 seconds, 100% of total time)

Example	Description	Time in seconds
spec/unit/resources/ufw_firewall_spec.rb:22	ufw_firewall with explicit rules is expected to install firewall "default"	0.10825
spec/unit/resources/ufw_firewall_spec.rb:24	ufw_firewall with explicit rules is expected to create firewall_rule "http"	0.09813
spec/unit/resources/ufw_firewall_spec.rb:39	ufw_firewall with action :delete is expected to disable firewall "default"	0.06456
spec/unit/resources/ufw_firewall_spec.rb:23	ufw_firewall with explicit rules is expected to create firewall_rule "ssh"	0.06407
spec/unit/resources/ufw_firewall_spec.rb:25	ufw_firewall with explicit rules is expected to create firewall_rule "dns"	0.0634
spec/unit/resources/ufw_firewall_spec.rb:40	ufw_firewall with action :delete is expected to run execute "reset default ufw rules"	0.0596
spec/unit/resources/ufw_firewall_spec.rb:41	ufw_firewall with action :delete is expected to purge apt_package "ufw"	0.05606
spec/unit/libraries/helpers_spec.rb:14	UfwCookbook::Helpers#normalized_rules normalizes array-form rules into a hash keyed by rule name	0.01249
spec/unit/libraries/helpers_spec.rb:38	UfwCookbook::Helpers#recipe_rules_from_node collects cookbook and recipe scoped firewall rules from the expanded run list	0.00075
spec/unit/libraries/helpers_spec.rb:30	UfwCookbook::Helpers#rule_command maps nil and create to allow for firewall_rule compatibility	0.00033