Convert oem_iptables_hook to iptables-restore.

This should be the last remaining caller of iptables in netd.

Bug: 28362720
Test: bullhead builds,boots
Test: netd_{unit,integration}_test pass
Change-Id: I73f7ee15462576d92bc4c6d2006cc1555fe5731a