Defer configuration by default and manage vpn-router.conf with ucf

Add platform = none as the shipped default so installing the package
changes nothing on the machine until a platform is chosen. Add a mode
setting (manual/interfaces/auto) controlling how much of the network
configuration is supplied versus detected from the system. Manage
/etc/vpn-router/vpn-router.conf with ucf instead of writing it once,
so dpkg-reconfigure can safely reapply debconf answers without
clobbering local edits. Extend NAT/forward rules to all local subnets,
not just the first.

debian-package/src/usr/share/doc/vpn-router/vpn-router.conf.example

@@ -17,13 +17,25 @@
 # and leaves the host reachable and unchanged.
 
 [general]
-# Platform module to load: generic, azure or gcp.
-platform = generic
+# Platform: none, generic, azure or gcp.
+#   none    - configuration is deferred. Files are installed and nothing on
+#             this machine is changed. Set a real platform when ready.
+#   generic - configure, with no platform-specific additions.
+platform = none
+
+# How much of the network configuration you supply, and therefore how much is
+# read from the system:
+#   manual     - interface names, int_addr and int_gateway_ip are all given
+#                below. Nothing is detected.
+#   interfaces - the two interface names are given; int_addr and
+#                int_gateway_ip are read from them.
+#   auto       - nothing is given. The interfaces are identified from the
+#                routing table. Convenient, and able to get it wrong.
+mode = manual
 
 [interfaces]
-# The two inputs everything else is built on. Names only: the addresses on
-# these interfaces are read from the system, never configured here.
 # External faces the untrusted network; internal faces the protected one.
+# Required in manual and interfaces mode; worked out for you in auto mode.
 external =
 internal =
 
@@ -39,7 +51,10 @@ local_id_mode = fqdn
 [local]
 # Local subnets advertised into the tunnel, comma-separated.
 cidrs =
-# Next hop on the internal side for the subnets above.
+# This host's own address on the internal network, and the next hop on that
+# side for the subnets above. Both are required in manual mode and read from
+# the internal interface in the other two.
+int_addr =
 int_gateway_ip =
 
 [remote]