ruleset: properly deal with wildcards in zone device selectors

ruleset: properly deal with wildcards in zone device selectors

Translate iptables style wildcards (`name+`) to nftables ones (`name*`)
and ensure that such wildcards are not used as anonymous set items but
that they're tested by separate expressions.

Also move redundant zone device/subnet selection expressions into a common
template and include it where applicable.

Finally add a new testcase which covers various device name wildcard corner-
cases and rule permutation requirements.

Signed-off-by: Jo-Philipp Wich <jo@mein.io>