Restructure tests and fix first logic test
Fix off by one

Now we get exactly the burst and not burst-1 packets
Update test description
Add performance test
Speedup by optimization

We avoid using the datagram:parse_n() functions and similar to get the
ethernet header and IPv[46] header so we can dig out the source IP.
Instead we do a simple check in the iovec using an offset. First to look
at the ethertype and determine if it's an IPv4 or IPv6 packet and then
dig out the source IP address.

We do use the datagram object later for matching against our rules but
this speeds up the task of getting the source IP, which is the first
thing we need to do before we can check if an IP is in the blocklist.

Packets that are blocked is taking a shortcut through the code and so
this speeds up that shortcut tremendously. My laptop shows 10x
improvements, from a measly ~700Kpps to just over 7Mpps.