Various changes to support a more dynamic configuration.

Changed the template to write to a more dynamic location, based on OS and whether we are writing the real file or the temporary file.

Added two new attributes and enabled them in the stock template;
    iptables_input_default_deny (default 1) tells erubis that the template should set the INPUT chain's default deny rule to LOGDROP or LOGACCEPT if set to zer0.

    iptables_output_default_deny (default 1) tells erubis that the template should set the OUTPUT chain's default deny rule to LOGDROP or LOGACCEPT if set to zer0.

Set the service default to nothing so that no action is taken unless we want to really enable iptables.