docs: use scoped UFW rules for Waydroid networking

[xDestac]

Summary

• Replace the global UFW forwarding policy change with a route rule scoped to waydroid0, the Waydroid subnet, and the selected host uplink.
• Restrict DHCP and DNS rules to the Waydroid bridge.
• Explain how to identify the active host uplink and handle multiple uplinks.

Why

The existing instructions open ports 53 and 67 on every interface and change UFW's forwarding policy globally.

On the tested system, UFW's FORWARD policy dropped Waydroid traffic before it reached the host uplink, even though Waydroid's nftables rules were present. The scoped rules restore connectivity without changing UFW's default forwarding policy.

Tested

• CachyOS with Waydroid 1.6.3-1, MAINLINE vendor, and the vanilla image.
• Confirmed DNS queries reached waydroid0 but not the host uplink while UFW blocked forwarded traffic.
• Confirmed DHCP supplied the address, gateway, and DNS after applying the scoped firewall configuration.
• Confirmed raw IPv4 and DNS connectivity after a UFW reload and a full Waydroid restart.
• Confirmed connectivity survived eight freeze/unfreeze cycles.

Related to waydroid/waydroid#1250.