For the use case with a separate base chain, we want to preempt other
firewall rules by default and insert our immediate jump rule at the
beginning, rather than at the end. Add an option to provide the other
behaviour.
Change-Id: I16171f7c028c89b94823ecc99387771be3ba9443