mxrouter: Generalize ipsets

[donald]

Currently mxrouter supports only a single ipset with a fixed name,
type, source filename and option set.

Switch to a more general scheme, where the mxrouter config file can
define and use multiple ipsets with different properties.

Syntax:

ipset(setname,type,filename,options...)

e.g.:

ipset('ip-blacklist','hash:ip','/etc/local/mxrouter/ip-blacklist','counters');
...
rule('filter','FORWARD','-m set --match-set ip-blacklist src -j DROP');

At the same time, switch to an atomic swap, so that we can't end up
with a incomplete ipset if we hit an error after processing the
input file only in part.

Still unsupported: Types other than 'hash:ip', because before we can use
other types, we'd need to defined a syntax for the file.