APF: filter unwanted ARP replies

This patch adds APF filtering of ARP replies for interfaces with APF.

- when the interface has no IPv4 address, broadcast ARP replies with a
  0.0.0.0 target ip are dropped (GARP), ARP requests with a 0.0.0.0
  target ip are dropped.

- when the interface has an IPv4 address, broadcast ARP replies to a
  different ip are dropped (including GARPs to 0.0.0.0), ARP requests to
  a different ip are dropped.

Bug: 29404209
Bug: 30080487
Change-Id: I82613eb865c7f38b6260997fe2caf2aff382ad78