[client] Allow INPUT traffic on the compat iptables filter table for nftables

[lixmal]

Describe your changes

Issue ticket number and link

For FORWARDed traffic, we already installed blanket "allow wt0" rules in the filter table (created by iptables) to avoid blocking our traffic that we filter in the netbird table (nftables) ourselves.
For consistency, we also need to do the same for the INPUT chain, in case the policy is set to DROP.

Additionally, this fixes a bug where two rules with different protocols would collide and only one would be opened.

Minor additional changes:

• Add missing Flush for static rules, to avoid error logs on shutdown
• Move netstack DNS forwarder code from the engine to the DNS forwarder manager
• Add env var NB_NFTABLES_TABLE to specify NetBird's table name
• Remove obsolete existing filter table rules when running nftables

Stack

Checklist

• Is it a bug fix
• Is a typo/documentation fix
• Is a feature enhancement
• It is a refactor
• Created tests that fail without the change (if possible)

By submitting this pull request, you confirm that you have read and agree to the terms of the Contributor License Agreement.

Documentation

Select exactly one:

• I added/updated documentation for this change
• Documentation is not needed for this change (explain why)

Docs PR URL (required if "docs added" is checked)

Paste the PR link from https://github.com/netbirdio/docs here:

https://github.com/netbirdio/docs/pull/__

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud