Added support for 'managed = local_secondary'.

This works similar to 'managed = secondary', inside a cluster of
zones, connected by routers with managed=local or
managed=local_secondary.
If a rule is already filtered by a router with managed=local,
then a router with managed=local_secondary only checks for
source network and destination network.
Simplified test /unnumbered/
Allow unnumbered crosslink network
Crosslink network must match 'filter_only' now.
Optimized deny rules to protect interfaces.

Ignore the trailing "permit any any" rule of local packet filters.
Fixed "protect interfaces" if object-group is used