Process user iptables rules before INVALID

Process user iptables rules before INVALID

Process user-defined iptables rules before the INVALID DROP
rule. This is to allow scenarios where the VMs need to
legitimately receive packets that conntrack doesn't have an
entry for (e.g. SYN-ACK where the SYN wasn't sent by the VM).
A user can accomplish this by adding an allow rule that matches
the headers of these INVALID packets so they get permitted before
they hit the INVALID DROP rule.

Closes-Bug: #1460741
Change-Id: Ie6ce5f3fa688f1bf25b77db5955211922d9fe85b