beta: public IP rewriting using DNAT

MediaWiki on the beta cluster would often attempt to query some API
using the DNS entry (ie: en.wikipedia.beta.wmflabs.org).  The DNS server
would serve the public IP address of another instance and NAT would not
let the instance communicates between each other.

The fix is to rewrite outgoing destination address from the public IP
address to the private IP address it is bound to.  The iptables rules
have been applied manually until then and disappeared whenever an
instance got rebooted.  That caused major headhaces to the Wikidata team
for a few months now.

We used to maintain iptables rules using Augeas, a system that nobody
understand.  Nowadays we are using ferm, a tiny wrapper around iptables
which make it way easier to add iptables rules.

I first define a list of hardcoded mappings then call a custom define
using the nice create_resources() puppet utility.  I did such a thing
previously for the protoproxy configuration on beta (see d0b881e6 /
https://gerrit.wikimedia.org/r/#/c/63431/ ).

Should be the equivalent of generating the following iptables rules:

  iptables -t nat -I OUTPUT --dest 208.80.153.219 \
    -j DNAT --to-dest 10.4.1.133
  iptables -t nat -I OUTPUT --dest 208.80.153.242 \
    -j DNAT --to-dest 10.4.0.211
  iptables -t nat -I OUTPUT --dest 208.80.153.243 \
    -j DNAT --to-dest 10.4.0.51
  iptables -t nat -I OUTPUT --dest 208.80.153.244 \
    -j DNAT --to-dest 10.4.0.48
  iptables -t nat -I OUTPUT --dest 208.80.153.143 \
    -j DNAT --to-dest 10.4.1.82

RT #4824
bug: 45868

Change-Id: I958a6d4aa1fb701aaccb2e9622c5a71e0d3fd93b