Don't run traffic on the INPUT chain through warden-dispatch

Traffic between the host and its containers must not be limited in any
form. Only traffic between containers, and between containers and the
outside networks must be limited. To achieve this in the filter table,
warden no longer intervenes on traffic on both the INPUT and FORWARD
chains, but only on the FORWARD chain.

For easier introspection into what is going on this change also removes
the fast path for non-SYN TCP packets. If this proves to be a big
performance hit, it can be put back in place.

The network filtering tests are changed to no longer rely on the
internet being reachable when the suite it run. Filtering is now tested
by running multiple containers and testing reachability between them.
Make net_in test more robust