Netfilter config is not handled on runsc boot, reopen of: "DNS not working in Docker Compose"

### Description

See #115
Which was closed pretty prematurely.

The problem is that docker-compose uses a special netfilter config that remaps `127.0.0.11` in a pretty funny way.
I.e.:
```
Chain DOCKER_OUTPUT (1 references)
pkts bytes target prot opt in out source destination
0 0 DNAT tcp -- * * 0.0.0.0/0 127.0.0.11 tcp dpt:53 to:127.0.0.11:40107
3 232 DNAT udp -- * * 0.0.0.0/0 127.0.0.11 udp dpt:53 to:127.0.0.11:33195

Chain DOCKER_POSTROUTING (1 references)
pkts bytes target prot opt in out source destination
0 0 SNAT tcp -- * * 127.0.0.11 0.0.0.0/0 tcp spt:40107 to::53
0 0 SNAT udp -- * * 127.0.0.11 0.0.0.0/0 udp spt:33195 to::53
```
That's why udp to `127.0.0.11:53` doesn't work.
Which brings us to the bug itself: if gvisor already copies `lo` routes and `arp` config, why shouldn't it do the same for `netfilter` stuff?
I think it should, otherwise these bugs will crop up.
Will try to assemble a PR on that soon.

### Steps to reproduce

See #115

### runsc version

```shell
548d12773965831811b2fe719df0c8c0da4e8a61
```

### docker version (if using docker)

```shell
Client: Docker Engine - Community
Version: 20.10.14
API version: 1.41
Go version: go1.16.15
Git commit: a224086
Built: Thu Mar 24 01:48:02 2022
OS/Arch: linux/amd64
Context: default
Experimental: true

Server: Docker Engine - Community
Engine:
Version: 20.10.14
API version: 1.41 (minimum version 1.12)
Go version: go1.16.15
Git commit: 87a90dc
Built: Thu Mar 24 01:45:53 2022
OS/Arch: linux/amd64
Experimental: false
containerd:
Version: 1.5.11
GitCommit: 3df54a852345ae127d1fa3092b95168e4a88e2f8
runc:
Version: 1.0.3
GitCommit: v1.0.3-0-gf46b6ba
docker-init:
Version: 0.19.0
GitCommit: de40ad0
```

### uname

Linux machine1 5.17.2-051702-generic #202204111357-Ubuntu SMP PREEMPT Mon Apr 11 14:08:56 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

### kubectl (if using Kubernetes)

_No response_

### repo state (if built from source)

_No response_

### runsc debug logs (if available)

_No response_