Choice of address and match of fascist_firewall_allows_address* need to consider ipv6

Right now, when we decide "can we reach node X", we only pass the node's primary address to fasist_firewall_allows_*.

Also, when we decide whether to use an primary or secondary address, we don't look at fascist_firewall_* as far as I know.