DOCKER-USER chain and DOCKER-INGRESS cleanup

[fcrisciani]

The 2 chains requires a specific configuration ordering where the DOCKER-USER is always on top of the DOCKER_INGRESS.
The current code handles the configuration of the 2 in separate functions and code path, up to the point that bugs like: #1827 are being exposed.
The patch: #1845 addressed the specific issue, but looks like there can be some code cleanup that can be done to ensure that there is only one chain programming codepath that will always ensure correct ordering without the need to do subsequent rule delete/create to fix it

[wenjianhn]

It seems a bit complex.