Re-enable bandwidth accounting, disabled some other things

Mike Perry reported some security and usability issues. This patch
corrects some, but there is others requirering some deeper changes.

Corrections:

- close orbot local ports so that no app can access it "by chance". Only
  especially authorized apps may access the TransPort. Polipo (8118) is
  now closed, as well as SOCKS and TransPort

- enable accounting, using a (new) dedicated chain "accounting". This
  one just links to bw_OUTPUT in order to make Quota work again. Seeing
  how it's done, it's possible we can even see which app eats bandwidth,
  at least fir the outgoing data.

- we flush OUTPUT completely before doing anything. This allows some
  easier configuration.

- INPUT chain is now managed in such a way nothing may enter unless it's
  related to TOR traffic

There's also some cleanup in iptables rules, and, well, now, it's locked
up. For good.