Update getting-started/quickstart demo network to use the firewall CNI plugin

[sipsma]

We need a fix to the firewall CNI plugin, which I've submitted a PR for here, but once that's merged we should update the demo network to use it as it results in more consistent success in setting up forwarding from VMs to all networks the host has access to (relative to the ptp plugin's ipmasq attempts, which seem hit or miss especially if the host already has iptables rules configured).

My previous test with a patched firewall plugin found that simply appending it after ptp but before tc-redirect-tap in the existing demo network conflist resulted in VMs consistently getting outbound network access where previously they did not.