feat(wireguard): allow WireGuard UDP port globally via firewalld

Removes the IP-based firewall rich rule that restricted WireGuard UDP
access to specific admin CIDRs. This change configures firewalld to allow
the WireGuard port globally, relying on WireGuard's internal cryptographic
key authentication for access control.

ansible/roles/wireguard/tasks/main.yml

@@ -55,17 +55,25 @@
     state: started
     daemon_reload: true
 
-- name: Allow WireGuard UDP port from admin CIDRs
+- name: Remove old WireGuard UDP port rich rules from admin CIDRs
   ansible.posix.firewalld:
     rich_rule: >-
       rule family="ipv4" source address="{{ item }}"
       port port="{{ wireguard_port }}" protocol="udp" accept
     zone: drop
-    state: enabled
+    state: disabled
     permanent: true
     immediate: true
   loop: "{{ admin_allowed_cidrs.split(' ') }}"
 
+- name: Allow WireGuard UDP port globally (auth via crypt key)
+  ansible.posix.firewalld:
+    port: "{{ wireguard_port }}/udp"
+    zone: drop
+    state: enabled
+    permanent: true
+    immediate: true
+
 - name: Allow DB ports from WireGuard subnet only
   ansible.posix.firewalld:
     rich_rule: >-