packages: BCP38 support for openwrt

This adds firewall support for blocking common invalid address
ranges, using ipset.