for some usages, specially with autostart enabled, user might want to
launch only the systray.

this commit implements a simple ``--nowindow`` switch that just avoids
showing the main window for now. in the future, we can have a different
entrypoint that just launches bitmaskd and a minimal systray widget.

I'm not documenting this feature properly since I think this is still
missing some functionality: the ability to switch on and off the vpn,
and the ability to pass the --autostart as a flag to the bitmask
entrypoint.

for now, we'll be hardcoding tcp as a more reliable alternative, no
matter what the provider announces.

explicitely specifying ipv4 should fix the case in which vpn fails to
start because ipv6 is disabled.

-Resolves: #9181, #9129

honor the anonymous certificate for the providers that offer it.
this still needs a change in bonafide, in which if provider supports
anonymous access we still have to download eip-service.json

for testing, I assume this has been already manually downloaded.

In ubuntu 17.10 some changes with systemd-resolved broke our firewall,
blocking all DNS queries. The masquerade rules in the firewall, that
are used to rewrite the source IP address of the DNS queries, were
wrongly modifying the queries to systemd-resolved.

Let's apply masquerade only to the packets addressed to the nameserver.

- Resolves: #9137