Parse `virtuals` before `rules`

[Svedrin]

When we include this rule from the default rules file:

# Src-Zone      Dest-Zone        Src-Address          Dst-Address            Service        Action
ext             ALL              ALL                  ALL                    ALL            reject

the virtuals don't work anymore because this rule is included in MFWFORWARD before the ones that allow virtuals traffic be forwarded.

Should we fix this by parsing virtuals before rules?

[Svedrin]

hmm no, I like the fact that rules are omnipotent and if the rules say "no", then it's a solid "no". But let's emit a warning if there are clashing rules.