Refactor IpsetManager to have proper separation of concerns

IptablesFirewallDriver and IpsetManager don't have a proper seperation of concerns,
the current implementation of IptablesFirewallDriver has a lot of low level knowledge
about how ipset works, and how to optimize the way we work with ip sets.

There are also misleading references to ipsets as "ipset_chains" in IptablesFirewallDriver,
those references should be corrected to "ipsets" or "sets" to avoid confusion.

The extent of this change should not modify functionality, and unit tests checking the
specific knowledge previously handled in the IptablesFirewall Driver should be moved
to talk with the IpsetManager now.

Intent here is to provide a better foundation for later L2 agent refactors which otherwise
would find the same issues with the IpsetManager needing to reimplement it's logic
partially.