Let userland proxy handle container-bound traffic

This changeset does two things:
- allow connections to the userland proxy on all interfaces (not only `lo`);
- allow connections originating from containers to reach the userland proxy, instead of being natted.

It allows containers to "talk to themselves" on their exposed ports; i.e., without that change, a container with a `55432->80` mapping could not connect to `hostaddr:55432`, neither could other containers when L2 isolation was enabled (with e.g. `ebtables -P FORWARD DROP`).

The only side-effect is that those connections will now be shown as originating from the host. It is deemed to be a minor inconvenience. Note: external connections are not affected, and containers will still see their true origin.