"Block UDP outbound" firewall policy

[danderson]

A quick real-world test revealed the UC Berkeley guest network is intolerant of UDP traffic. All outbound UDP seems blocked except for well-known destination ports. :443 destination permitted, and DNS is very likely okay as well (although we didn't test).

This is a useful case to test. My plans to date only included different filtering behavior for inbound traffic, not outbound.