Use subset matching instead of is_contained_in() to select a child_cfg

Use subset matching instead of is_contained_in() to select a child_cfg

If one selector has a wider IP range than the other, but the other has a
wider port/protocol selector than the first one, none is completely contained
in the other. The check for a match using is_contained_in() therefore would
fail. Using get_subset() can handle such cases, fixing configuration selection.