Improve firewall samples (lo interface & ct states)

Remove the incorrect use of -s 127/8 on the lo interface.

Consolidate conntrack state matches.

Remove unnecessary OUTPUT rule; users should add their own state matching if
custom OUTPUT filtering is done.