Add ipv6 frag matchers2 and generify known_boolean handling.

Adds tests for ipv6, too.

ip6tables handles fragmentation differently. There's a special
module and a couple 'frag' of matchers which are all needed to
implement a stateless firewall correctly.

known_boolean handling has been generified.
Before the known_boolean functionality was partly tailored
to the :socket feature.

Rebase of https://github.com/puppetlabs/puppetlabs-firewall/pull/156