Reload firewall rules

See the discussion at #9263 (closed) about integration of bitmask into existing firewall setups. @meskio suggested to implement bitmaskctl vpn fw_reload which would be super nice so we don't need to hack around too much. This could be called from a post-firewall hook after (re-)connecting to a network.