Netfilter integration

[qdeslandes]

Integrate daemon-less bpfilter to Netfilter. There are multiple paths to achieve this, given Netfilter provides different front-ends (nft, iptables-legacy, iptables-nft).

Requires extensive design.