Support private resource destinations on egress rules

[vitramir]

matcher.private_resource_id names a private resource as a rule's destination, mutually exclusive with domain_pattern and fixed for the rule's life. Only http/https resources in the rule's organization are accepted; matcher.ports stays public-only.

• A private-target rule provisions no OpenZiti service — it rides the resource's. Its attachment policies select the resource by the #private-resource-<id> role attribute, which survives the service being recreated, so attaching the rule is what grants reachability and detaching revokes it.
• The resource's first rule and last flip its mediation through Networks.SetPrivateResourceMediation (best-effort; the Networks reconciler re-derives every pass, so a missed call heals).
• upstream_tls (server_name, ca_bundle_secret_id xor insecure_skip_verify) validated for private https targets; the CA bundle secret joins the referential-integrity count.
• ListEgressRulesByAgent/ByEnvironment carry the referenced resources' intercept_host and protocol, read live from Networks on the lookup path, so the gateway needs no Networks call per request. A resource that cannot be resolved is omitted; the gateway refuses rather than guesses.
• Internal RPCs for the Networks service: CountRulesReferencingPrivateResource (delete and protocol-change guards), ListMediatedPrivateResources (mediation re-derivation), ListAttachedRuleDomains (grant-time collision fast-fail).
• Attach-time fast-fails in both directions: a public rule refused when the target already reaches a resource intercepting its domain (Networks.ListPrivateResourcesReachableBy), a private rule refused when a public rule for the resource's hostname already reaches the target. Best-effort by design — group and environment writes reach the same state elsewhere.
• Each reconciliation pass reports every agent authorized for two overlapping interceptions — expanded through environment attachments and, via the Networks response, group grants — as intercept collision: log lines naming the identity and how each side was acquired. Reported, never repaired.
• The per-domain uniqueness index is dropped: several rules may name one destination, which is how two agents reach one internal host with different tokens.
• Chart: internal AuthorizationPolicy entries for the three new RPCs (networks SA) and for ListEgressRulesByEnvironment (egress-gateway SA), which was missing.

Part of egress rules address private resources; protocol change in agynio/api#193.