right now at least on gcp and probably elsewhere a config is mandatory to delete associated fw rules https://github.com/nanovms/ops/blob/master/gcp/gcp_instance.go#L287-L320
since we auto-create these by default and are tagging them as made by ops we should be able to scan for these resources and auto-delete them as well w/out needing a config