DNSFilter: Handle default filter through iptables instead of dnsmasq.

This way, we can allow clients to bypass the default filter.
This should also work better with things that modifies DNS servers
handled by dnsmasq, such as VPN clients.
webui: Clarify label of the default DNSFilter mode
webui: Code cleanup (no functionality change)