feat(settings): prevent public firewall outbound subnets

internal/configuration/settings/firewall.go

@@ -26,6 +26,12 @@ func (f Firewall) validate() (err error) {
 		return fmt.Errorf("input ports: %w", ErrFirewallZeroPort)
 	}
 
+	for _, subnet := range f.OutboundSubnets {
+		if !subnet.Addr().IsPrivate() {
+			return fmt.Errorf("%w: %s", ErrFirewallPublicOutboundSubnet, subnet)
+		}
+	}
+
 	return nil
 }