functions.m4, classify.m4: Handle negative address ranges.

That is, a network can explicitly exclude an address range.  Ranges are
checked in order, so you carve out a hole in the middle of a range by
putting a negative range first for the hole first, and the big network
afterwards.

This involves a fairly major rearrangement of the address classification
machinery.  Again.