Move NatController startup to iptables-restore.

This makes NatController startup much faster. Before:
02-03 14:09:19.199   485   485 I Netd    : Setting up NatController hooks: 223.4ms

After:
02-03 14:28:09.407   488   488 I Netd    : Setting up NatController hooks: 13.8ms

Also, fail if MSS rewriting is not supported. It's much easier
to diagnose a failure than a performance problem.

Test: unit tests continue to pass
Test: bullhead builds, boots, wifi tethering works
Fix: 17629786
Bug: 34873832
Change-Id: I0ef498ecbbb82a2672c279056d189d026e13100a