When preparing destination addrs for firewall rules we combine all the IPs, networks and IP ranges into non-overlapping IP ranges to avoid nftables errors since nftables don't accept overlapping elements.

Initially this meant that all networks got converted into ranges which caused issues with BSD packet filter which generates a separate rule for each IP in range. As a workaround we skipped converting networks into ranges, but this meant that we could no longer guarantee generated elements to be non-overlapping.

This PR introduces the ability to extract all possible subnets from generated ranges, thus resolving both of the above issues (networks are not needlessly turned into ranges and elements no longer overlap).