Attribute driven ipf rules

I've refactored most of the cookbook to be attribute-driven and have sane (and slightly paranoid) default behavior.