Which data flow direction is protected in a zero trust firewall deployment that is not protected in a perimeter-only firewall deployment?