feat: switch fail2Ban banaction to ipset

[buildplan]

switch fail2Ban banaction to ipset and update UFW SSH rules to limit for improved security and performance

• Updated the Fail2Ban installation logic to install both fail2ban and ipset dependencies.
• Modified the Fail2Ban default configuration to use banaction = iptables-ipset-proto6-allports instead of ufw.
• Replaced all instances of ufw allow "$SSH_PORT" with ufw limit "$SSH_PORT". This natively restricts brute-force attempts at the kernel level (max 6 connections / 30s per IP)

thanks for the suggestion @GuinnessDublin