Support manipulating throw routes.

We already supported unreachable routes. Throw routes are
necessary so we can exempt the VPN endpoint from being routed
through the VPN in legacy VPN modes that do not pass traffic
through a tun or ppp interface but just directly appply IPsec
transformations to outgoing packets.

Bug: 17462989
Change-Id: I8635472ca3e96ec2866af2de48e6260ab2da13fb