NSX-T Firewall Translation

Upload the NSX Manager's live "Firewall Configuration" CSV export (Security → East-West Firewall → Export Configuration) — optionally together with a Groups export, a Services export, and/or a group-membership export; each file is read by its content, not its extension, so CSV and JSON can be mixed freely. Rules whose source/destination resolve to real IPs (a raw IP, ANY, a Groups export, or a membership export) and whose service resolves to a real protocol/port (a built-in default, or a Services export) get translated to GCP Firewall Policy Terraform; everything else comes back flagged with the reason, not silently guessed.