Add Restricted Mode Firewall Chain

Adding a new allowlist firewall chain to support restricted networking
mode. See go/restricted-networking-mode.

Bug: b/157505406
Test: atest netd_integration_test && atest netd_unit_test
Change-Id: I0028e6fa47460e5516d759c5807a459a4700a83e