network: remove unnecessary links iptables rule

Currently there are two iptables rules per port for each link: one for
parent connecting to the child's port, and another one for return
traffic from the child back to the parent.  The second rule isn't needed
because the "ctstate RELATED,ESTABLISHED" rule can already handle all
established traffic.

So this patch does the following:

1. Move the ctstate rule to be _before_ the potential inter-container
   communication DROP rule so it will work for inter-container traffic
   as well.  Since we're inserting, it should be inserted after we
   insert the DROP.  This also has a small performance benefit because
   it will be processed earlier and it's generally one of the most
   commonly used rules.

2. Get rid of the unnecessary return traffic rule per link.

3. Also move the other "Accept all non-intercontainer outgoing packets"
   rule to earlier.  This gives a small performance benefit since it's
   also a commonly used rule, and it makes sense to logically group it
   next to the ctstate rule.

Docker-DCO-1.1-Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com> (github: jpoimboe)