add default-drop ferm output policy

[adeck]

Naturally, accept ESTABLISHED,RELATED, and accept anything root does (because root must fetch updates, etc., and besides root can just reset iptables, anyway, so it'd just be security theater either way).