update ss-rules

add ipset rules support.
by default, use ipset, if the device supports it.
update readme