Avoid producing empty Juniper route-filter sets

An empty 'from {}' stanza will be removed by JUNOS, which causes the
resulting policy-filter to accept all routes, which is hardly the
expected or desired result. This patch fixes that by replacing an empty
set of routes with a single route-filter entry that will reject all
routes for the given address family.