fix(zone): detect same source/interface in zones

fix(nftables): rich: source address with netmask

fix(nftables): do not log icmp block if inversion

fix(ipset): disallow overlapping entries

fix(policy): warn instead of error for overlapping ports

docs(conf): note that IPv6_rpfilter has a performance penalty

fix(nm): reload: only consider NM connections with a real interface

fix(ipset): fix hash:net,net functionality

fix(direct): rule order with multiple address with -s/-d

rebase to v0.9.3
fixes from upstream branch stable-0.9

feat(service): add galera service

fix(zone): add source with mac address

fix(rich): non-printable characters removed from rich

fix(nftables): packet marks with masks
fix(nftables): icmp types with code == 0
fix(rich icmptype): verify rule and icmptype families
fix(zone): cache rule_str for rich rules
improvement(service): IPsec: Update description and add TCP port 4500
feat(service): add collectd service
feat(service): Add rpc-rquotad.service

fix(cli): add ipset type hash:mac is incompatible with the family parameter
fix(cli): add --zone is an invalid option with --direct
fix: update dynamic DCE RPC ports in freeipa-trust service
fix: core: rich: Catch ValueError on non-numeric priority values
fix(rich): icmptypes with one family
fix(direct): rule in a zone chain
plus additional upstream stable fixes