[border-router] firewall: ingress filtering (#7043)

This commit implements part of the OTBR firewall. This implementation
focuses on the ingress filtering part. We may also introduce egress
filtering part when necessary.

For security purpose, there are some packet forwarding rules to
follow, which were originally introduced in the spec.
- Inbound packets initiated with On-Link addresses source (OMR and
  mesh local prefix based addresses) should be blocked.
- Inbound unicast packets whose destination address is not OMR address
  or DUA should be blocked.
- Inbound unicast packets whose source address or destination address
  is link-local should be blocked. Note that we don’t need to
  explicitly add rules for link-local addresses since this should
  already be handled by the kernel.

These rules can be easily implemented by iptables and ipset.
- Before otbr-agent starts, there is a script creating the iptables
  rules. The rules themselves are constant so we don't need to change
  them dynamically.
- During the runtime of otbr-agent, otbr-agent updates ipsets
  accordingly whenever there's a change of on-link prefixes.

tests/scripts/thread-cert/node.py

@@ -1657,7 +1657,7 @@ class NodeImpl:
         omr_addrs = []
         for addr in self.get_addrs():
             for prefix in prefixes:
-                if (addr.startswith(prefix)):
+                if (addr.startswith(prefix)) and (addr != self.__getDua()):
                     omr_addrs.append(addr)
                     break