fix(k3s): deny pod sources the etcd client port 2379

The etcd client API listens on the masters' static LAN address, and the
pod-source deny lists omitted it. Add 2379 to both nft drop lines and
assert it in the security-k3s-pod-firewall eval test. 2381 (etcd
metrics, scraped by in-cluster monitoring) stays reachable by design.

Pairs with the matching Cilium egressDeny port in k8s-gitops.

Assisted-by: DeepSeek Harness (gpt-6-astra)

outputs/x86_64-linux/tests/security-k3s-pod-firewall/expr.nix

@@ -28,6 +28,7 @@ lib.genAttrs (builtins.attrNames outputs.nixosConfigurations) (
     && acceptAt != null
     && dropAt < acceptAt
     && lib.hasInfix "2049" rules
+    && lib.hasInfix "2379" rules
     && lib.hasInfix "5432" rules
     && lib.hasInfix "5902" rules
 )