Add secmark/var + render blrules/conntrack/secmark/vars

- Add secmarks (id-keyed) and vars (key-keyed) resources: migration 0009, model,
  store CRUD, REST handlers.
- Compiler rendering for the global-compiled tail: blrules, conntrack, secmarks
  render on enforcing devices; vars render on every device. This closes the
  rendering gap left by batch 1 (blrules/conntrack were stored but not rendered).

internal/model/global2.go

@@ -0,0 +1,20 @@
+package model
+
+// SecmarkRule applies an SELinux security mark (global-compiled).
+type SecmarkRule struct {
+	ID      int64    `json:"id"`
+	Secmark string   `json:"secmark"`
+	Chain   string   `json:"chain"`
+	Source  string   `json:"source,omitempty"`
+	Dest    string   `json:"dest,omitempty"`
+	Proto   string   `json:"proto,omitempty"`
+	DPort   []string `json:"dport,omitempty"`
+	SPort   []string `json:"sport,omitempty"`
+	Comment string   `json:"comment,omitempty"`
+}
+
+// Var is a global key-value substitution variable.
+type Var struct {
+	Key   string `json:"key"`
+	Value string `json:"value"`
+}