fix(nftables): always flush main table on start

fix(ipset): fix configuring IP range for ipsets with nftables

fix(ipset): exception on overlap checking empty set

rebase to v0.9.11

change default CleanupModulesOnExit=yes

feat(config): add CleanupModulesOnExit configuration option
change default CleanupModulesOnExit=yes

fix(zone): detect same source/interface in zones

fix(nftables): rich: source address with netmask

fix(nftables): do not log icmp block if inversion

fix(ipset): disallow overlapping entries

fix(policy): warn instead of error for overlapping ports

docs(conf): note that IPv6_rpfilter has a performance penalty

fix(nm): reload: only consider NM connections with a real interface

fix(ipset): fix hash:net,net functionality

fix(direct): rule order with multiple address with -s/-d