autofix: correct ingress and egress policies

Previously, the egress policy was of the form:

  (filter vlan = egress; vlan := 1) | id

This had the effect of both ejecting packets from the network, and
allowing them remain in the network. At the next hop they would have
been elminated, so this was technically correct, but at the cost of
duplicating all traffic, which is unacceptable. The new policy is this:

  (filter vlan = egress; vlan := 1) | (filter not(vlan = egress); id)

This will ensure that egress packets are ejected and not duplicated,
while leaving internal packets unchanged.