Use o-r-c instead of first-boot.d for iptables.

This is the only use of first-boot.d, which is somewhat problematic for
a number of reasons. Using o-r-c the script can be made semi-idempotent
and then we can consider eliminating first-boot.d from
diskimage-builder.

Change-Id: I6e675d4fddda44af388eb5eaea7b3a9697092948