On packages removal (!= purge) systemd units are masked.
The postinst script has then to reenable this units at the
beginning of the 'configure' step.
Our other packages are doing this manually, or automatically
when the dh_systemd_enable helpers generated a postinst,
but this was missing here.
case "$1" in
configure)
+ # Remove masks created by dh_systemd_enable on package removal.
+ deb-systemd-helper unmask pve-firewall.service >/dev/null || true
systemctl reload-or-restart pve-firewall
;;