bpf-firewall: move destruction of IP firewall objects to bpf-firewall.c

bpf-firewall: move destruction of IP firewall objects to bpf-firewall.c

These are so many runtime objects, let's add a bpf_firewall_close()
helper that destroys them all, and call that from unit_free(), simply as
an excercise of encapsulating more BPF code in bpf-firewall.c.

This also brings the destruction order and variable declaration order in
struct Unit into the same systematic order.

No change in behaviour just some minor refactoring.