router_linux: remove need for iptables.ListChains().

Instead of retrieving the list of chains, or the list of rules in a
chain, just try deleting the ones we don't want and then adding the
ones we do want. An error in flushing/deleting still means the rule
doesn't exist anymore, so there was no need to check for it first.

This avoids the need to parse iptables output, which avoids the need to
ever call iptables -S, which fixes #403, among other things. It's also
much more future proof in case the iptables command line changes.

Unfortunately the iptables go module doesn't properly pass the iptables
command exit code back up when doing .Delete(), so we can't correctly
check the exit code there. (exit code 1 really means the rule didn't
exist, rather than some other weird problem).

Signed-off-by: Avery Pennarun <apenwarr@tailscale.com>

wgengine/router/router_linux_test.go

@@ -399,8 +399,8 @@ func (o *fakeOS) ClearChain(table, chain string) error {
 		o.netfilter[k] = nil
 		return nil
 	} else {
-		o.t.Errorf("unknown table/chain %s", k)
-		return errExec
+		o.t.Logf("note: ClearChain: unknown table/chain %s", k)
+		return errors.New("exitcode:1")
 	}
 }