fw/b: Prevent double interface restriction remove on interface name change

* When temporarily removing a restriction owing to interface name
  change, update the boolean state array to match.  Otherwise, we
  get out of sync, follow-on double removes can occur and the system
  server will crash.

* In addition, it was observed that it is possible to receive a network
  callback for a (VPN) network that has both WIFI and VPN transports set (it
  looked transient rather than persisent but difficult to tell).  So make
  the list of use cases in priority of match order, putting VPN first.

Change-Id: If484b5a715e0a972769c847ea4549fd84afb3ccf