Support destination-port ranges in egress rules

[huzaifa-d]

Allow a network rule to specify an inclusive range of destination ports, rather than requiring a separate rule for every port.

Example	Expected behaviour
TCP ports 8000–8010	Match TCP ports 8000 through 8010, including both endpoints.
UDP ports 5000–5010	Match UDP ports 5000 through 5010, without matching TCP.
Allow 8000–8010, but deny 8005	Port 8005 remains blocked.
End port below start port, or end port without a start port	Reject with a clear validation error.

Keep ports within 1–65535. Verify both range boundaries and adjacent ports that must not match.

MXC schema requirement: ports[].port and ports[].endPort, for example:

{ "protocol": "tcp", "port": 8000, "endPort": 8010 }