Consider a firewall-controller downloader instead of installing release version directly

[Gerrit91]

If we had a component which is pulling and installing the right firewall-controller version (found out through seed client, same lookup mechanism as in current firewall-controller) instead of directly putting the firewall-controller release into the images, this would prevent old firewall-controllers to come up, which we need to support for a very long time.

So, this change would allow us to change easier without having to consider backwards-compatibility all the time.

[Gerrit91]

Don't know the current state and if this fits here, but by default a firewall should only open 443 and DNS, such that the downloader can reach the kube-apiserver and pull the firewall-controller image. All other ports should be closed and only opened if this is an unmanaged firewall run without Gardener.