Major network restructuring.

We now have a globally routable /28.  Use this as the DMZ and the
network backbone.  The main servers (ibanez, radius, roadstar, jem,
artist and vampire) are on both the DMZ and the unsafe network.
radius is now the main internal router, though vampire is still on
several networks because it provides DHCP and DNS services.

This new configuration makes essential use of the ability (added to
defiface) to accept multiple interface names by setting lists of names
into the interface variables if_FOO.

There's another aspect of the routing complexity which we must address
here: multicasts can arrive on any of several trusted networks, and we
should accept them all.  (We must cope with interface name lists in the
interface variables here, and deduplicate.)