ApfFilter: more precise IPv4 broadcast filter

This patch refines the Apf IPv4 filter for interfaces with Apf
capabilities to drop packets when:
  - the multicast lock is not held
  - the packet is an IPv4 packet
  - the packet is not a DHCP packet addressed to us
  - the packet is L2 broadcast, or IPv4 multicast, or IPv4 broadcast
      - caveat: subnet broadcast address is not checked.

This allows to drop IPv4 broadcast packets whose MAC destination
address is not the L2 broadcast address but the current address of the
interface. Such packets can be received on network that rewrite L2
addresses and can put significant pressure on battery by waking up the
phone unnecessarily.

Bug: 30231088

Change-Id: I8b1785fc5ceadaa1f2881765983e502135dcbc46