Reject outbound connectivity from containers by default

* Allow 'ESTABLISHED,RELATED' traffic on input chain to allow responses
  from containers to flow back to the host
* Allow access DNS access and TCP access for net_in 'hairpin' test
* Flesh out default networking configuration connectivity tests

[#71585346]

Signed-off-by: Michael Fraenkel <fraenkel@us.ibm.com>