Calculate WireGuard AllowedIPs by subtracting "disallowed" subnets from "allowed" subnets. Supports both IPv4 and IPv6 CIDR.