Add a throw route to the VPN endpoint.

Without this, legacy VPN types that don't send all traffic
through a tun or ppp interface, but instead have the kernel
apply IPsec transforms directly to the original packets, will
try to send traffic to the VPN endpoint through the VPN, which
will not work.

Bug: 17462989
Change-Id: I3ebf0cec726dd12b2c57ba5d66775f8c02b25b70