Allow the negation of source and destination addresses

The bulk of this work is allowing IP address normalisation to work while
still maintaining an optional exclamation mark at the beginning of the
parameter.

Usage: put '! ' before the existing destination or source

Example:

  firewall { 'rule name':
    ensure      => 'present',
    chain       => 'POSTROUTING',
    destination => '! 192.168.122.0/24',
    jump        => 'MASQUERADE',
    proto       => 'tcp',
    source      => '192.168.122.0/24',
    table       => 'nat',
    toports     => '1024-65535',
  }

Added some simple spec tests.

This allows the specification of the default rules added by a libvirt installation. Tested on CentOS 5.9, Puppet 2.6.19.

Fixes #125