Change how the reject property of the firewall type works

It is no longer necessary (or possible!) to specify
    action  => 'reject',
when using the 'reject' property.  It is added the same way that '--module'
arguments are added.

If you want to use the default --reject-with, one can either specify that or
still use "action => 'reject'"

Problem this fixes:  --reject-with needs to come after '-j REJECT', and
sometimes it would randomly not be the case.  Effectively, using
"-j <NON_BUILTIN_OR_CHAIN_TARGET_NAME>" pulls in the required extended target
module (in this case, /lib/iptables/libipt_REJECT.so -- or /lib64/.../).

Problem this doesn't fix: we'll have the same problem with the LOG target,
and this solution won't work with that (if we have two different things that
requires the LOG extended target, which we might).