SecondaryTableController: force the MSS to match pmtu on TCP SYN

Without this change, the VPN sets up a tun/ppp that needs a small
MTU, and during TCP SYN the MSS will end up matching the outgoing iface
MTU which is potentially too big.
This leads to connection flakiness. The wrong MSS is visible by
tcpdump-ing on the tun/ppp device.

With this change, the MSS now is correct.
It requires the kernel to be configured with
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
If kernel is not configured, it silently fails.

Bug: 11579326
Change-Id: I254d8c39435b92dff91931e461e1efb8b35f6b1e
Mark uids without rules with PROTECT_MARK

The default result for a uid without a mark should be MARK_PROTECT
because the service using the uid's mark may be covered by a VPN that
should not cover the user it is acting for.

Bug: 12608570
Change-Id: I2402cb86ddb2fe6e670d1793263ff6c2c31d32fe
Move VPN routing decisions from iptables to ip

Routes are now encoded by ip rules that send connections to the Vpn
table if the connection is marked and the destination falls into a
route. This differs from the previous design where a mark meant that
the connection must go over the VPN, now a mark simply means that it
may.
Bug: 12549060
Change-Id: I9be7e27a0f46858f109d8bc5c5bced309b05201a
Update clearifaceforuidrange to take the interface

resolv's uid range=>iface map now allows overlap in uid ranges to support
simultaneous tuns. _resolv_clear_iface_for_uid_range now takes the
interface to support removing only one of the rules.

Bug: 12134439
Change-Id: I3e2a167875bbd381846d5c47d7b34c625abfb2e0
Allow overlap in UidMarkMap

To support simultaneous tuns UidMarkMap now allows for
overlaping/duplicate rules. If there are multiple rules for a given uid
the most recently added rule will be used in all cases.

When overlapping rules are added in addUidRule there may be multiple
iptables rules matching the uid. Since addUidRule appends it will use
the most recent rule as well, no change required. Previously
UidMarkMap->add would fail and the rule would never be added.

Bug: 12134439
Change-Id: I5f2976dd3ee334584a9f98f6eacd5edbe5c9bb6b
Merge "Update clearifaceforuidrange to take the interface" into klp-dev
Merge "Allow overlap in UidMarkMap" into klp-dev
Merge "Move VPN routing decisions from iptables to ip" into klp-dev
Move VPN routing decisions from iptables to ip

Routes are now encoded by ip rules that send connections to the Vpn
table if the connection is marked and the destination falls into a
route. This differs from the previous design where a mark meant that
the connection must go over the VPN, now a mark simply means that it
may.
Bug: 12549060
Change-Id: I9be7e27a0f46858f109d8bc5c5bced309b05201a
Merge tag 'android-4.4.3_r1' into HEAD

Android 4.4.3 release 1