Add configurable VPN access policies (#1505)

## Summary

- add independent install options for internet routing, client-to-client
access, and explicit server-side networks
- enforce the selected policy across firewalld, nftables, and iptables,
including DCO traffic
- use destination-scoped NAT for home LAN access and preserve client
routes and DNS in split-tunnel mode
- document the new defaults and add focused Docker policy coverage

Defaults remain internet access enabled, client-to-client access
disabled, and server-side network access disabled.


Related: #1496 #443 #385 #624 #547 #1436 #1103 #1126 #575 #1434 #1213
#147

test/Dockerfile.client

@@ -19,7 +19,8 @@ RUN mkdir -p /dev/net
 
 # Copy test scripts
 COPY test/client-entrypoint.sh /entrypoint.sh
-RUN chmod +x /entrypoint.sh
+COPY test/policy-peer-entrypoint.sh /policy-peer-entrypoint.sh
+RUN chmod +x /entrypoint.sh /policy-peer-entrypoint.sh
 
 WORKDIR /etc/openvpn