Set the outbound connection rules

Replaces one scope's outbound connection policy: its three settings and its whole ordered rule list, in one step. mode is untrusted (check only destinations that untrusted input chose) or all (check every connection); default is allow or deny (what happens when no rule matches); on_violation is block or report. Null or an empty string for any of the three means inherit. Each rule is {action: allow|deny, target, note}; a target is *, an IP address, a CIDR range, a host name, *.domain, @internal, @metadata, or an http(s) URL prefix, with an optional :port. Targets come back in canonical form. A bad row is a 400 naming the row number. At most 128 rules per scope. Machines pick the change up on their next config fetch, within about 30 seconds. Cookie callers must pass CSRF.

This is a write: a read-only API key is refused with 403.