Clear incoming packet mark rules on netd startup.

Currently, we put the incoming packet mark rules directly into
the INPUT chain of the mangle table, which is not cleared on netd
start. Move these rules to their own chain. This makes them
consistent with all the other iptables rules and makes it easy to
clear them on startup using the existing mechanisms.

Bug: 28362720
Test: bullhead builds, boots
Test: netd_{unit,integration}_test pass
Test: watch -n1 "adb shell iptables -v -n -t mangle -L INPUT" while switching networks
Test: rules are cleared on netd restart
Change-Id: I9130f997a96dcfdfdfdd950520a76f8473b5f603