correctly init PVEFW-FORWARD chain

We generate that chain by default, so the old code never triggered.
improve logging

Also log dropped inter-bridge traffic.