As pointed out in PR4506, a somewhat breaking change was introduced that partially reverted changes made in T6841, while completing the target for T7452.

Currrent behaviour requires both vrf and interface to be declared if using the ZBF with vrfs, as traversing traffic otherwise might not be matches outbound, and therefor default to the default behavoir of the ruleset.

The changes made in both of those tasks should be reimplemented as "new" function aligning with the initial goals from both.

The new implementation should allow for matching traffic both traversing the firewall and originating from the firewall itself.