fix handling of builtin chains

MOAR PULL REQUESTS!!!

There were several issues with regards to the handling of builtin chains.

First there were a couple places where a check was being performed to determine whether the provider was trying to create/delete a built-in chain. This check was broken and would never match.

Then there was an issue where if the iptable_nat module wasn't loaded, the nat chains wouldn't exist, and so the provider would try to create them. I added an exemption for the built-in chains so that the provider thinks they're always there, even if the module hasn't been loaded. We leave it up to the kernel to automatically load the module if/when we try and use that table.

In theory this negates the need for the built-in chain check on `def create`, but I left it in.