[do not merge] introduce oo-gear-firewall

Actually using cp easily preserves selinux context on the target file. This iptables file isn't updated by anything automatically, only administrative action, so it did not seem worth the trouble of locking it.