Add secmark/var + render blrules/conntrack/secmark/vars

- Add secmarks (id-keyed) and vars (key-keyed) resources: migration 0009, model,
  store CRUD, REST handlers.
- Compiler rendering for the global-compiled tail: blrules, conntrack, secmarks
  render on enforcing devices; vars render on every device. This closes the
  rendering gap left by batch 1 (blrules/conntrack were stored but not rendered).

internal/compiler/compiler.go

@@ -52,6 +52,10 @@ type Input struct {
 	TCFilters    []model.TCFilter
 	TCInterfaces []model.TCInterface
 	TCPriorities []model.TCPriority
+	Blrules      []model.BlruleRule
+	Conntrack    []model.ConntrackRule
+	Secmarks     []model.SecmarkRule
+	Vars         []model.Var
 }
 
 // RenderedConfig is the per-device output served to the agent.
@@ -86,6 +90,10 @@ type RenderedConfig struct {
 	TCFilters    []RenderedTCFilter    `yaml:"tc_filters,omitempty" json:"tc_filters,omitempty"`
 	TCInterfaces []RenderedTCInterface `yaml:"tc_interfaces,omitempty" json:"tc_interfaces,omitempty"`
 	TCPriorities []RenderedTCPriority  `yaml:"tc_priorities,omitempty" json:"tc_priorities,omitempty"`
+	Blrules      []RenderedBlrule      `yaml:"blrules,omitempty" json:"blrules,omitempty"`
+	Conntrack    []RenderedConntrack   `yaml:"conntrack,omitempty" json:"conntrack,omitempty"`
+	Secmarks     []RenderedSecmark     `yaml:"secmarks,omitempty" json:"secmarks,omitempty"`
+	Vars         map[string]string     `yaml:"vars,omitempty" json:"vars,omitempty"`
 }
 
 // RenderedSNAT is a resolved SNAT/masquerade rule: source addresses masqueraded
@@ -235,6 +243,7 @@ func Render(in Input) (*RenderedConfig, error) {
 	renderPerDevice(in, out)
 	renderPerDeviceL2(in, out)
 	renderTraffic(in, out)
+	renderGlobal2(in, out)
 
 	return out, nil
 }
@@ -516,5 +525,17 @@ func Compile(ctx context.Context, s *store.Store, device string) (*RenderedConfi
 	if in.TCPriorities, err = s.ListTCPriorities(ctx); err != nil {
 		return nil, err
 	}
+	if in.Blrules, err = s.ListBlrules(ctx); err != nil {
+		return nil, err
+	}
+	if in.Conntrack, err = s.ListConntrack(ctx); err != nil {
+		return nil, err
+	}
+	if in.Secmarks, err = s.ListSecmarks(ctx); err != nil {
+		return nil, err
+	}
+	if in.Vars, err = s.ListVars(ctx); err != nil {
+		return nil, err
+	}
 	return Render(in)
 }