firewall: reload nftables in mgmt VRF

It doesn’t matter for the rules themselves as nft does not do VRFs,
but DNS names can only be resolved there. This is because all nodes
use the same IPs in the default VRF, so DNS replies sent from there go
to the active node.

This allows using DNS names in firewall rules. Not yet sure if that is
actually a good idea.

roles/firewall/files/update

@@ -4,7 +4,7 @@ set -e
 
 apply() {
 	cp -R /opt/config/etc/nftables.d /etc || return 1
-	nft -I /etc/nftables.d -f /etc/nftables.nft || return 2
+	ip vrf exec mgmt nft -I /etc/nftables.d -f /etc/nftables.nft || return 2
 	cp -R /opt/config/etc/wireguard /etc || return 3
 	wg syncconf wg /etc/wireguard/wg.conf || return 4
 }