Fix support for simultaneous VPN tuns

A VPN can once again bring up a new tun interface while the old tun is
running. Once the new tun is set up the routing rules will be removed from the
old tun. It is up to the application to drain the old tun of traffic and
close it.

If the new tun fails to come up the old tun will remain untouched and
can still be used.

To prevent leakage the new rules are added before the old tun is
shutdown. Netd/Dns has been changed to allow multiple rules to exist
at once with the most recently added rule taking priority.

Bug: 12134439
Change-Id: I7e00c7c68cc339d81f09b3d2a33276ffc76985f5