secchan: Track datapath actions in userspace, to avoid system calls.

secchan: Track datapath actions in userspace, to avoid system calls.

Until now, secchan had no way to determine when datapath actions actually
changed, and so it had to be conservative and update all flows' actions,
or almost all, in some circumstances.

With this commit, secchan keeps track of flows' actions in allocated memory
and only updates them in the datapath when they actually change.

As part of the change, this factors out common code into new functions
rule_install() and rule_uninstall(), which should make secchan more
maintainable.