Remove monit permit access and NATS firewall setup

[rkoster]

Summary

• Remove cgroup v1 net_cls-based monit API access control mechanism
• Remove monit wrapper script, helper functions, and iptables rules
• Remove permit_monit_access call from agent startup

The monit binary now runs directly without a wrapper. Access control will be managed by the bosh-agent's internal firewall implementation.

This prepares the stemcell builder for the bosh-agent changes that move firewall management into the agent itself.

Related

• Add UID-based nftables firewall for NATS and monit connections bosh-agent#399
• Add bosh-monit-access helper for nftables firewall pxc-release#97 (pxc-release was the only consumer of permit_monit_access)

[rkoster]

Don't merge before: cloudfoundry/bosh-agent#399

[abg]

Per the comment from @colins from the related pxc-release PR

@rkoster there is some more work to do for this. Specifically for backward compatibility for some MySQL components. We'd need some like monit-access-helper.sh in jammy so that we don't break features for customers.

Adding some color here:

This monit-access-helper.sh pattern is apparently being used by some of our internal bosh releases - this usually involves some niche database workflows that do some in-place restore like stopping the database service, putting some files in places and starting the service again.

Would it be acceptable if we kept monit-access-helper.sh for the ubunt-jammy stemcell, but reimplemented in terms of the nftables work? Maybe pulling in some of the work from cloudfoundry/pxc-release#97 into bosh-agent and adding some additional /var/vcap/bosh/bin/bosh-monit-access helper?

That may make sense as a follow up backwards compatibility PR.

[rkoster]

Yes I'm not against backward compatibility, it is just out of scope for the use case that I'm interested in so me personally won't be doing the work. That being said I'm happy to review a PR adding backward compatibility.