Add support for TPROXY via new TransTPRoxy option

Based on patch from "thomo" at #10582.
Move the friendly warning about TPROXY and root to EPERM time

I'm doing this because:
   * User doesn't mean you're running as root, and running as root
     doesn't mean you've set User.
   * It's possible that the user has done some other
     capability-based hack to retain the necessary privileges.
Add a sandbox rule to allow IP_TRANSPARENT
Merge branch 'feature_10582'