(#10665) Add real persistence for iptables 

Supports iptables and ip6tables on EL and Debian clones.  Replaces the
previous recommendation of using an Exec resource, which required manual
setup and wasn't able to persist purges of unmanaged rules.

Requires that the `iptables-persistent` package is installed on Deb-alike
machines. This is supported by a new firewall manifest/class.

In most cases it hopes for the `osfamily` fact from Facter >= 1.6.2 but
falls back to an abridged list of `operatingsystem` values.