Move enableChildChains to iptables-restore.

This saves 100-200ms on boot.

(cherry picked from commit 0b64071d)

Bug: 37641280
Test: marlin builds and boots
Test: new unit test passes
Test: netd_{unit,integration}_test pass
Test: fw_dozable added/removed from fw_INPUT/fw_OUTPUT on "adb shell dumpsys deviceidle <force-idle|unforce>"
Change-Id: Iaa8daba011cf187d07526b2b85f9e9aba83adf4f
Merged-In: Iabd2fa6ea260495feee3335b1605f3699b1722c5