nixos/firewall-nftables: fix multicast ping

We can currently observe that pinging the multicast IPv6 address ff02::1
does not work as expected. This is because conntrack is marking the
ICMPv6 replies as invalid and thus is dropping them.

This can behaviour can be seen with these commands:
1. Get handle of the rule above the conntrack rule:
   ```
   nft -a list ruleset inet
   ```
2. Insert a rule to log all packets marked as invalid by conntrack:
   ```
   nft insert rule inet nixos-fw \
     input position <handle> ct state invalid \
     log prefix \"ct invalid: \"
   ```
3. Starting pinging ff02::1 and observe dmesg

This change adds a rule to allow all ICMPv6 echo replies (type 129)
before the conntrack rule starts taking action.

Signed-off-by: David Wronek <david.wronek@mainlining.org>

nixos/modules/services/networking/firewall-nftables.nix

@@ -117,6 +117,10 @@ in
           ifaceSet != ""
         ) ''iifname { ${ifaceSet} } accept comment "trusted interfaces"''}
 
+        # Multicast ICMPv6 echo replies get marked as invalid by conntrack.
+        # Accept them before conntrack to avoid dropped replies.
+        icmpv6 type echo-reply accept
+
         # Some ICMPv6 types like NDP is untracked
         ct state vmap {
           invalid : drop,