If there is an unclean container termination (eg. OOM), the kresd cache files
can get corrupted (especially the lock.mdb). Additionally, there are issues with
PID namespacing that can cause the cache to not work
right (cf. https://gitlab.nic.cz/knot/knot-resolver/-/issues/637).

So to avoid these issues, we remove the cache on startup, and accept a
cold-cache init.

If we were to remove these on shutdown, they may not get removed if the
container terminates unclean.

The version in Debian is very old and has issues.

We revert to shapeshifter-dispatcher because obfsvpn is not working yet, and we
also do not need vpnwatch.

The udp service was not passing the same arguments as the tcp one, this fixes
the missing --syslog flag

iproute2 needs to be explicitly installed, the iptables alternative needs to
iptables-legacy.

We need 2.5 for block-ipv6

use the stretch image, at least until #2 is fixed.