vzctl.spec: don't disable conntracks if firewall is used

Unfortunately, conntracks is not only used for NAT/MASQERADE,
but also for 'state RELATED,ESTABLISHED' iptables rules, so if
those are used, disabling conntracks will lead to non-working
networking on host system.

Therefore, add one more check (to one in commit f17350f) and
do not disable conntracks if state RELATED and/or ESTABLISHED
is used in current iptables rules.

Signed-off-by: Kir Kolyshkin <kir@openvz.org>
vzctl compact: use built-in PATH

In case /usr/sbin is not in PATH, vzctl compact fails.
Fix by using the built-in PATH.

https://bugzilla.openvz.org/2990

Reported-by: Pavel Odintsov <pavel.odintsov@gmail.com>
Signed-off-by: Kir Kolyshkin <kir@openvz.org>