Process firewall_rule resources at compile time

This allows us to avoid deferring the creation of the shorewall
configuration and hence prevent it restarting with a partial set
of rules when something else fails.