feat: allow GUEST VLAN (101) internet access

Añade regla de firewall L3 en posición 3 para permitir
que los clientes de la VLAN GUEST (10.2.40.0/21) accedan
a internet.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

sites/BCN01-LAB/firewall.auto.tfvars

@@ -22,6 +22,17 @@ firewall_rules = [
     dest_port      = "any"
     syslog_enabled = false
   },
+  {
+    # Permite que los clientes GUEST (VLAN GUEST) lleguen a internet
+    comment        = "Permitir GUEST a internet"
+    policy         = "allow"
+    protocol       = "any"
+    src_cidr       = "10.2.40.0/21"  # VLAN 101 - GUEST
+    src_port       = "any"
+    dest_cidr      = "any"
+    dest_port      = "any"
+    syslog_enabled = false
+  },
   {
     comment        = "Bloqueo temporal switch a 8.8.8.8"
     policy         = "deny"