several ipset-related felix crashes removed

ICMP rules with no "port" (actually, type/code) would make felix crash.
Worked around by iterating through icmp code types, but it appears that
ipset is not good for filtering icmp/* and we should probably use
iptables.

0.0.0.0/0 sources crashed felix - log a warning & replace with two rules
for 0/1 and 128/1.

Fixed ipset matching of _port rules (it was set to purely src or dst,
when it should have been "src,dst" for ingress (to_port) or "dst,dst"
for egress (from_port) rules.