iptables: make starting and stopping the systemd service more robust

- don't fail to start the service if the rules-save file doesn't exist yet (e.g. initial configuration)
- add workaround with /bin/sh -c to actually make saving work (taken from the Gentoo service file)
app-editors/vim-runmtime: enable syntax highlighting as default

Change-Id: I3aefbdd8c9c16665b34556457d286cfe62fe383d