Move per-container forward rules to DOCKER chain

Closes #6034

Docker-DCO-1.1-Signed-off-by: Ian Bishop <ianbishop@pace7.com> (github: porjo)
@discordianfish The link rule can't safely be appended to the FORWARD chain. Many rulesets will have a deny-all rule as the last rule, and so the link rule would end up *after* that! Am I misunderstanding your comment?