(dhcpd/unbound) don't try to handle empty section, closes https://github.com/opnsense/core/issues/1320

Optimized dhcp_clean_leases()

This is a pretty good option for anybody with a lack of a viable
local mirror, sparked by talks of a South-East Asia region mirror.

FreeBSD added OpenVPN 2.4, but we're not ready yet.

(proxy) fix subnet computation using netaddr.IPNetwork, closes https://github.com/opnsense/core/issues/1309

(configd) add netaddr.IPNetwork to template helpers, for https://github.com/opnsense/core/issues/1309

(ids) add support for inline configuration settings (subscription based url's for example), add basic auth support.

Example supported format:

<?xml version="1.0"?>
<ruleset>
    <location url="https://www.snort.org/rules/snortrules-snapshot-2990.tar.gz?oinkcode=%%snort.oinkcode%%" prefix="Snort"/>
    <files>
        <file description="blacklist" url="inline::rules/blacklist.rules">snort.blacklist.rules</file>
    </files>
    <properties>
        <property name="snort.oinkcode" default=""/>
    </properties>
</ruleset>

---
Registers the setting "snort.oinkcode" which is used to construct the download url.
This commit doesn't include definitions for new content, in case someone wants to create a definition file, it should be easy now :)

Assume LAN unless we only have one interface and that is WAN.
If LAN is not there, no problem: the text will either show
WAN if it works or show LAN and do nothing.

We could argue that 1 interface that is not WAN or LAN is
possible and should receive anti-lockout too, but this would
change the previous behaviour too much and is not generally
possible from the GUI or console.

(mvc) fix mangled dropdown boxes on some inputs, reset all form_input_tr items to avoid further strangeness..