Luci is served by the web server uhttpd. So it will be uhttpd that could run your script.
If you just want to run a shell script, put it in /www/cgi-bin/ and flag it executable.
The url will then be:
http://192.168.1.1/cgi-bin/updatefirewall.sh?ip=3ba2:95bc:c00f:8d02:7b16:088e:8086:f980
EDIT: The query string, ie everything after the "?", is sent to the script in the variable $QUERY_STRING
Any output from your script will be shown on the browser, so you could generate suitable html in the script if you wanted to.
Here is an example: