[firewall] ingress filtering (#7107)

This commit implements OTBR firewall. This implementation focuses on
ingress filtering. We may also introduce egress filtering when
necessary.

For security purpose, there are some packet forwarding rules to
follow, which were originally introduced in the spec.

- Inbound packets initiated with On-Link addresses source (OMR and
  mesh local prefix based addresses) should be blocked.

- Inbound unicast packets whose destination address is not OMR address
  or DUA should be blocked.

- Inbound unicast packets whose source address or destination address
  is link-local should be blocked. Note that we don’t need to
  explicitly add rules for link-local addresses since this should
  already be handled by the kernel.

These rules can be easily implemented by iptables and ipset.

Before otbr-agent starts, there is a script creating the iptables
rules. The rules themselves are constant so we don't need to change
them dynamically. During the runtime of otbr-agent, otbr-agent updates
ipsets accordingly whenever there's a change of on-link prefixes.

tests/scripts/thread-cert/node.py

@@ -1719,7 +1719,7 @@ class NodeImpl:
         omr_addrs = []
         for addr in self.get_addrs():
             for prefix in prefixes:
-                if (addr.startswith(prefix)):
+                if (addr.startswith(prefix)) and (addr != self.__getDua()):
                     omr_addrs.append(addr)
                     break