rebase to v0.9.11

change default CleanupModulesOnExit=yes

feat(config): add CleanupModulesOnExit configuration option
change default CleanupModulesOnExit=yes

fix(zone): detect same source/interface in zones

fix(nftables): rich: source address with netmask

fix(nftables): do not log icmp block if inversion

fix(ipset): disallow overlapping entries

fix(policy): warn instead of error for overlapping ports

docs(conf): note that IPv6_rpfilter has a performance penalty

fix(nm): reload: only consider NM connections with a real interface

fix(ipset): fix hash:net,net functionality

fix(direct): rule order with multiple address with -s/-d

rebase to v0.9.3
fixes from upstream branch stable-0.9

feat(service): add galera service

fix(zone): add source with mac address