Add secmark/var + render blrules/conntrack/secmark/vars

- Add secmarks (id-keyed) and vars (key-keyed) resources: migration 0009, model,
  store CRUD, REST handlers.
- Compiler rendering for the global-compiled tail: blrules, conntrack, secmarks
  render on enforcing devices; vars render on every device. This closes the
  rendering gap left by batch 1 (blrules/conntrack were stored but not rendered).

internal/database/migrations/0009_secmark_var.sql

@@ -0,0 +1,19 @@
+-- Final long-tail sections: secmarks (SELinux security marking, global-compiled)
+-- and vars (global key-value substitution variables).
+
+CREATE TABLE secmarks (
+    id      BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
+    secmark TEXT NOT NULL,
+    chain   TEXT NOT NULL,
+    source  TEXT NOT NULL DEFAULT '',
+    dest    TEXT NOT NULL DEFAULT '',
+    proto   TEXT NOT NULL DEFAULT '',
+    dport   JSONB NOT NULL DEFAULT '[]'::jsonb,
+    sport   JSONB NOT NULL DEFAULT '[]'::jsonb,
+    comment TEXT NOT NULL DEFAULT ''
+);
+
+CREATE TABLE vars (
+    key   TEXT PRIMARY KEY,
+    value TEXT NOT NULL DEFAULT ''
+);