Add secmark/var + render blrules/conntrack/secmark/vars

- Add secmarks (id-keyed) and vars (key-keyed) resources: migration 0009, model,
  store CRUD, REST handlers.
- Compiler rendering for the global-compiled tail: blrules, conntrack, secmarks
  render on enforcing devices; vars render on every device. This closes the
  rendering gap left by batch 1 (blrules/conntrack were stored but not rendered).

internal/server/resources.go

@@ -64,6 +64,7 @@ func (s *Server) mountResources(r chi.Router) {
 	s.mountPerDevice(r)
 	s.mountPerDeviceL2(r)
 	s.mountTraffic(r)
+	s.mountGlobal2(r)
 }
 
 // respondOne writes a single resource, mapping ErrNotFound to 404.