systemvm: ipv6 fw_input — expand established/related to non-routed Isolated

Per upstream review feedback on #13173: drop the is_routed() guard on
fw_router_routing_v6() so non-routed Isolated v6 networks also accept
established/related return traffic to the VR.

Keep the is_vpc() guard (VPC has its own firewall path via
fw_vpcrouter_routing).

Scope stays narrow: only the established/related rules. v4's service-port
rules (tcp/3922, tcp/8080) are not mirrored into the v6 INPUT chain.

Tested on staging (4.22.0.0):

- Routed Isolated v6 (Filtered offering): BGP v6 sessions reach
  Established, eth2 established/related rule counter active
  (81 packets / 9893 bytes).
- Non-routed Isolated v6 (DualStack offering with VirtualRouter +
  SourceNat): fw_input contains lo/eth2/eth0 established/related rules
  identical to the routed case; counter activity on eth2
  (66 packets / 8369 bytes) confirms the rule is reached.

Signed-off-by: Jason Ball <jball@resetdata.com>

Author: Jason Ball

systemvm/debian/opt/cloud/bin/cs/CsAddress.py

@@ -716,13 +716,11 @@ def fw_router_routing(self):
                                      'rule': "iifname %s ip saddr %s tcp dport 8080 ct state new counter accept" % (self.dev, guestNetworkCidr)})
 
     def fw_router_routing_v6(self):
-        if self.config.is_vpc() or not self.config.is_routed():
+        if self.config.is_vpc():
             return
-        # IPv6 INPUT chain defaults — mirror of fw_router_routing() for v4.
-        # Without these, return traffic for VR-initiated v6 connections (e.g.
-        # BGP SYN-ACKs to upstream PE peers) is silently dropped by the
-        # default-DROP policy on fw_input. PR #10970 added the equivalent
-        # rule to fw_forward only; this completes that fix for INPUT.
+        # IPv6 equivalent of fw_router_routing() — without these, return
+        # traffic for VR-initiated v6 connections is dropped by fw_input's
+        # default policy.
         self.nft_ipv6_fw.append({'type': "", 'chain': 'fw_input',
                                  'rule': "iifname lo counter accept"})
         self.nft_ipv6_fw.append({'type': "", 'chain': 'fw_input',