Introduce basic firewall controls.

Creates a separate firewall chain that can be used to allow/deny
traffic based on rules.

Firewall is disabled by default.  When enabled, it supports four
types of rules: allowing traffic based on iface name, based on egress
source IP, based on egress destination IP and port, and based on
local UID.

Bug: 5756357
Change-Id: I97f894dca6bddb93b3c56478c5297f79d727cdab