Function cidr_to_acl 

pub fn cidr_to_acl(cidr: &Cidr) -> String

Converts a CIDR block into ACL format:

• /32 → “host x.x.x.x”
• otherwise → “network subnet-mask”