Move enableChildChains to iptables-restore.

This saves 100-200ms on boot.

Bug: 37641280
Test: marlin builds and boots
Test: new unit test passes
Test: netd_{unit,integration}_test pass
Test: fw_dozable added/removed from fw_INPUT/fw_OUTPUT on "adb shell dumpsys deviceidle <force-idle|unforce>"
Change-Id: Iabd2fa6ea260495feee3335b1605f3699b1722c5