firewall.py: catch SIGINT and SIGTERM too.

There were still a few conditions under some OSes that would cause
firewall.py to terminate without cleaning up the firewall settings.  'pkill
sshuttle' was one of them.  Ignore a couple more signals to further ensure a
correct cleanup.

(This only affects sshuttle --firewall, which is a subprocess of the main
sshuttle process.  The firewall is supposed to exit automatically whenever
the client exits, and so far that part seems to work reliably.)
Document missing --dns option in sshuttle manpage
Added --exclude-from feature.

(Slightly modified by apenwarr)