BandwidthController: fixup insertion pos in costly chain handling

* Long time ago, setting an alert in a costly_<iface> chain required adding
it just before the ACCEPT rule that was at the end.
But since then the ACCEPT rule has been removed.
This would cause the insert to pick the last position no matter what.
Now we just append.

* A naughty app in the penalty box could waste up quota on packets that would
get dropped in the later penalty_box rule.
Now we check the penalty_box before feeding it to the quota.

Change-Id: Id4b6a7c020583f1cccc7dccde34c4b85d0fd9642