use accept mark for security groups
improve parser

Also avoid that we read the group file multiple times.
group file does not need to specify interfaces.
jump to ACCEPT for IN rules
only use --mark for OUT chain
implement macros
use $rule->{dest} instead of $rule->{destination}
define more macros (converted most shorewall macros)
allow traffic from lo (PVEFW-INPUT)
use conntrack instead of state

-m state --state is deprecated
implement simple option parser
do not delete PVEFW-INPUT, PVEFW-OUTPUT and PVEFW-FORWARD chain.