luci-app-firewall: rework internal/external zone list handling when adding forwards