Added packetfilter::deny::forwarded subclass

This class includes packet filtering rules to block any unknown packets from
being forwarded. It is added to the end of the chain, so forwarding can be
enabled selectively before these rules are triggered.

Signed-off-by: Samuli Seppänen <samuli@openvpn.net>