Avoid needing to play with domain 0's firewall forwarding chain

We exempt bridged ethernet traffic from being processed by the
iptables forwarding chain by setting the sysctl at module load
time.

This brings bridge into line with the ovs.

Signed-off-by: David Scott <dave.scott@eu.citrix.com>