Have firewall accept ICMP Fragmentation Needed

[Patrick]

We drop all ICMP by default anyhow.

Reason for removal of RELATED:

• [Tails-dev] Reducing attack surface of kernel and tightening firewall/sysctls
• [Tails-dev] Reducing attack surface of kernel and tightening firewall/sysctls

Reason to be cautious:

• [tor-talk] Linux kernel transproxy packet leak (w/ repro case + workaround)

Reasons for not enabling RELATED by default:

• works great for years, nobody ever noticed
• Combining Tunnels with Tor

//cc @HulaHoop