Move per-container forward rules to DOCKER chain

Closes #6034

Docker-DCO-1.1-Signed-off-by: Ian Bishop <ianbishop@pace7.com> (github: porjo)
nit: Why use string(..) instead of ".."? If we don't want this to look like a ordinary string, given it's some logic, we could make it a constant.